base controller authentication method