Explicitly authorizing each controller method on Insitutions.