renaming: layouts controller
do not protect from forgery