authorize for rating controller