enable a per-controller auth strategy for Controller_Rest/Hybrid