fixed access-allow-controller-credentials