Thanks for the feedback! Agreed, it makes sense to refactor those routes into its own Auth controller. I will open a GitHub issue. However, some of the code is intentionally written that way to keep things stupid simple and easy to understand for developers of all skill levels, which you would normally encapsulate into a service in your own app.