add accessRules to DefaultController