cant authorizer be method on the controller?