put the callback in the favorites controller, alos re-added user auth requirement