restricing access to controller methods