Fix security on signup controller