auth moved to controller