authorization stuff, still need to figure out tests
can't figure out how to reload controllers, skipping for now