dao + controller for autorization