NEW: authorization redirect controller