added auth filter to base controller