added auth for controllers