Drying up controller and putting current user
check into policy scope