adding @PreAuthorize annotation on the controllers