add auth check to export csv controller