added authorisation to controllers