Looks like it can to me, I think this controller should require a user to be logged in.