add authorization, broke the static page controller