CatalogController authorization and routing fixes