added authorize in the timetable controller