In search there was a check on 'auth' in the view and we no longer
inject auth into views. That's why the check needs to be done on the
controller.
The other thing is that slash breaks the URL currently, so this commit
also changes slash in the search phrase into %2F character.