added a new controller to do the last step of the authorization process