added more autherization to controllers