auth controller improvements