Update controller: secure action