refs 6099 add authorize_function to controllers