Access policy

refs #181.
Additionally, some controllers and models are refactored.