added security checks to all controllers