code cleanup and secure all controllers