should this controller also have and authorization before filter?