moved authorization into controller