Moved Authorize to the controller class instead of actions