added some addition authorizations to reviews controller