security working after changes to controllers and routes