Extract Authorization from controller

And add attr_extras.