refactor auth into service, controller