fixed authentication in controllers