move login to AuthCtrl