Not thread-safe because there is one controller for all requests