diff --git a/controller/lobby.go b/controller/lobby.go
index 5bad277..2b6680b 100644
--- a/controller/lobby.go
+++ b/controller/lobby.go
@@ -24,6 +24,12 @@ var lobbies = make(map[string]Lobby)
 func CreateLobby(writer http.ResponseWriter, request *http.Request) {
 	writer.Header().Set("Content-Type", "application/json")
 
+	authOk := AuthHeaderIsValid(request.Header.Get("Authorization"))
+	if !authOk {
+		writer.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
 	lobbyId := cuid2.Generate()
 
 	result := LobbyResult{LobbyId: lobbyId}
diff --git a/controller/session.go b/controller/session.go
new file mode 100644
index 0000000..a1c7a9f
--- /dev/null
+++ b/controller/session.go
@@ -0,0 +1,25 @@
+package controller
+
+import (
+	"github.com/nrednav/cuid2"
+	"net/http"
+)
+
+var Users map[string]string = make(map[string]string)
+
+func Register(username string) string {
+	uid := cuid2.Generate()
+
+	// Store in the users map
+	Users[uid] = username
+
+	return uid
+}
+
+func ValidateId(writer http.ResponseWriter, request *http.Request) {
+	if AuthHeaderIsValid(request.Header.Get("Authorization")) {
+		writer.WriteHeader(http.StatusOK)
+	} else {
+		writer.WriteHeader(http.StatusUnauthorized)
+	}
+}
diff --git a/controller/utils.go b/controller/utils.go
index ddcd8d7..dfa9be3 100644
--- a/controller/utils.go
+++ b/controller/utils.go
@@ -1,10 +1,19 @@
 package controller
 
 import (
+	"fmt"
+	"net/http"
 	"strings"
 )
 
-func AuthHeaderIsValid(users *map[string]string, authHeader string) bool {
+func WriteError(err error, message string, writer *http.ResponseWriter) {
+	fmt.Printf("Error: %s\n", err)
+	(*writer).WriteHeader(http.StatusInternalServerError)
+	fmt.Fprintf(*writer, "{\"error\": \"%s\"}", message)
+	return
+}
+
+func AuthHeaderIsValid(authHeader string) bool {
 	// (try to) get the Bearer token
 	reqToken := authHeader
 	if !strings.HasPrefix(reqToken, "Bearer ") {
@@ -14,7 +23,7 @@ func AuthHeaderIsValid(users *map[string]string, authHeader string) bool {
 	bearerToken := reqToken[7:]
 
 	// Check that the token is in the global map
-	_, ok := (*users)[bearerToken]
+	_, ok := (Users)[bearerToken]
 
 	return ok
 }
diff --git a/main.go b/main.go
index 9460f26..f0a4f52 100644
--- a/main.go
+++ b/main.go
@@ -10,7 +10,6 @@ import (
 	"os"
 
 	"github.com/gorilla/mux"
-	"github.com/nrednav/cuid2"
 	"github.com/rs/cors"
 )
 
@@ -19,17 +18,12 @@ type PersonInfo struct {
 	Username string
 }
 
-var users map[string]string
-
 func main() {
 	fmt.Println("hello SEKAI!!")
 	router := mux.NewRouter().PathPrefix("/api").Subrouter()
 
-	// initialize the global users map
-	users = make(map[string]string)
-
 	router.HandleFunc("/register", Register)
-	router.HandleFunc("/validate", ValidateId)
+	router.HandleFunc("/validate", controller.ValidateId)
 	router.HandleFunc("/lobby/new", controller.CreateLobby).Methods("POST")
 
 	port, ok := os.LookupEnv("PORT")
@@ -53,29 +47,20 @@ func Register(writer http.ResponseWriter, request *http.Request) {
 	requestUrl := request.URL
 	params, err := url.ParseQuery(requestUrl.RawQuery)
 	if err != nil {
-		fmt.Printf("Error parsing URL parameters: %s\n", err)
-		writer.WriteHeader(http.StatusInternalServerError)
-		fmt.Fprintf(writer, "{\"error\": \"%s\"}", err)
+		controller.WriteError(err, "Error parsing URL parameters", &writer)
 		return
 	}
 
 	usernameArr, ok := params["username"]
 	if !ok {
-		fmt.Println("username GET param not found")
-		writer.WriteHeader(http.StatusBadRequest)
-		fmt.Fprintf(writer, "{\"error\": \"username not found\"}")
+		controller.WriteError(err, "username not found", &writer)
 		return
 	}
 	username := usernameArr[0]
 
-	uid := cuid2.Generate()
-
-	// Store in the users map
-	users[uid] = username
-
 	// The result json
 	result := PersonInfo{
-		UserId:   uid,
+		UserId:   controller.Register(username),
 		Username: username,
 	}
 
@@ -83,9 +68,7 @@ func Register(writer http.ResponseWriter, request *http.Request) {
 
 	jsonData, err := json.Marshal(result)
 	if err != nil {
-		fmt.Printf("Error in JSON marshal: %s\n", err)
-		writer.WriteHeader(http.StatusInternalServerError)
-		fmt.Fprintf(writer, "{\"error\": \"%s\"}", err)
+		controller.WriteError(err, "Error serializing JSON", &writer)
 		return
 	}
 
@@ -93,11 +76,3 @@ func Register(writer http.ResponseWriter, request *http.Request) {
 
 	fmt.Fprintf(writer, "%s", jsonData)
 }
-
-func ValidateId(writer http.ResponseWriter, request *http.Request) {
-	if controller.AuthHeaderIsValid(&users, request.Header.Get("Authorization")) {
-		writer.WriteHeader(http.StatusOK)
-	} else {
-		writer.WriteHeader(http.StatusUnauthorized)
-	}
-}