auth restrictions added to every controller