Moved controller security expressions to controller class hierarchy