Audit permissions on controller, and make some methods as private/protected: refs #658  #318