fix authorize controller