fixed authorization controller code