moved authenticateRequest() from Module to Controller