move to a base controller class
add custom authorization attribute

working towards having an admin view
admins can now edit character levels