Use declarative authorization in controllers