locking down controllers for authentication