Added actual Authorized controllers; separate from UserAware