add authorization controller