authorization checks now happening in views instead of controllers