auth decorators are not used anymore on __before__...
auth decorators are not used anymore on __before__
- this will allow to create a whitelist of API enabled controller functions
- moved around functions with _ to beginning of the files to make it cleaner