tweaked post controller
fixed a bug about returning unauthorized result for mobile devices