authorization check in clients controller