update for controller.dispatch
add note about server auth