added auth for all controllers with header links