Updated TODO: Authorize MVC actions based on verb