it's already under protected, what do I miss? (probably all protected in application controller should be private, but I wanted to stick with existing code)