add authentication check to controllers