moved authorization to application_controller, minor auth styling.