put security on all controllers