added security rules on rating controller