more authentication controlls for all controllers