@Secure and @Allow annotations now work on parent controller classes to target a whole hierarchy