Secure all actions in the application controller.

Some had earlier been missed and allowed for non logged in users
to reach and/or to call them.