added security to staff controllers, misc