modify authorization middle controller to also take non-keyworded arguments