Update SettingController.php

prevent direct access