Moved the restriction to application-controller