fix: use controller path as an additional key in auth hooks