All controllers are protected