AuthController and profile.ejs was protected by policies from unauthorized access