Refactoring authentication so that logic is contained in controller