add search to people controller, must be authorized to update person