moved app controller to auth file