authenticate user in app controller