Improved security around EndUser controller