don't require authorization for document check controller method