adding authorization to submissions controller