added authorization to all controllers and views