added control before auth