add security to cards controller