Support multiple id values in controller action authorization