pulled authorize logic out to application controller