Authorization checking in controller