categories controller, authorization improvements