force authentication in controller