add annotation authorization to controller and function