refactor on server controllers, moved all auth related methods into auth controller