some commit
authorize_action methods in auth_controller and auth_service