add authorize method to main controller.