no sense to make method protected, should be callable from controller