changed authorize action in controller