moved to auth controller