restrict access to internal controller
added timeout to XML::XMLRPC call