add rules in menu
add auth in controllers