Refactored authorisation logic out of controllers