added authorization to locations controller