add [Authorize] to controller