changed intermediate controller authorization to global