promoted some statements in base controllers to protected virtual methods