protect controllers with basic security