Simple access control dsl for controllers