that check needs to be done *additionally* to the } else {

now everybody can access the controller, who can edit *any* componentId