call controller authorize