* actions are public
* helpers on top of private
* everything else is an implementation detail in a controller.

makes it clear what is for what

* account properties (such as is mail crypt enabled) need to be queried and cannot be provided by auth anymore (since auth is now done through login.i.c)
* if an account is an admin is now supplied by saml property

TODO: some initial session information missing, since we do not
auth ourselves anymore.

TODO2: store and pass sso ticken to the backend