updated to the new model. controller is a security layer