- controller actions are now save against read/write rights