Style fix
Added permissions gathering methods, made most not-public controller methods protected as otherwise they are listed as actions