modified application controller - authenticate with auth token