Don't load the controller if the user isn't authenticated.
Unify create and update into put.