added security to works controller