added authorize in the settings controller