made request private in controller