fixed security model across all other controllers