fixed authentication by re-ordering before action in pin_controller