Decoupling in auth controllers