comments authorization of controller and views