The whole controller is behind the firewall for admin.