fixed authorizations

added find_user and authorize in controllers