working on authorizations in application controller and user controller