edited the controller so that authorization is checked for now