added authorization for bids controller