test mystery solved, isAuthorized on User controller set up