fixed application controller so that json requests can access json paths
using only cookie auth