Controller level auth.