adds json file with list of controllers to bypass authorization