first steps toward good authorization

has check_authorization in the application controller
remove it later on