added files controller
Restrict files access to permitted users