field security, controller validation
change model#Securigy comment
specs controller && simple view