auth dev & add controller rules