Added controller authorization checks, fixed checkbox tree bugs