Refactor auth for better readability

**Feature request**
It would be great to have notifications for controllers.

**Use case**
Many users need this functionality for production deployments.

**Implementation idea**
Add a new config option `enable_notifications` with default `false`.

Start by locating the controller implementation and the existing configuration entry points in the repository. Trace how controller events are handled and whether any notification path already exists. Done means a disabled-by-default enable_notifications option is supported and controller notifications behave as specified, but the issue does not define the notification mechanism or affected files.

Written by the indexing model from the issue text.