controller authorization works (tested on route/control point)
check authorization in views to hide actions that are not authorized