add controller protection using cancan