Added security to lists controller