auth_file in controller role