add authorization to client-backend controllers