Decorate actions with AllowReturnUrl attribute when necessary
Added authorization roles when needed