Writing Admin/User/Public controllers to insure authentication

"How can this be less portable than hard-coding everywhere?" - For autoloading it is not hard-coding everywhere, it is hard-coding within one single place: https://github.com/ivantcholakov/starter...toload.php It is a manageable way. Even, if you must place a specific class within a weird directory due to an external reason, you may use a map within a configuration file.

"It's the same with everything: function, class name, configuration item..." - For the specific task of loading classes I can avoid bothering about this aspect, so I do it.