lead controller require auth