It's *Action* Controller, not active controller. Also, write the authenticator in a non-Concern manner