Basic security on controller actions, null checks