adding method process_confirmation to the app controller to alow permision