move authorization logic to a user_application_controller