added APIController to handle auth and set user