minor fix on authentication for whole controller