Both cost and dashboard controller now verify the current user has access to the requested page.