moved the @PreAuthorized annotation from controller to service class