more security work... securing the controller methods