add password protection to private controller