403 forbidden when calling custom controller from Nuxt

on the public or authorized role?