filter to keep users on the right controller