Fix String to ObjectId in models
Add authorization to controllers