fix all controllers to update only accessible attributes