additional rule on all controller
rule only authorized people who can access website