Implementing authorization in controllers + async