added authorize_admin to all controllers