added access control to controllers documentation