protected controller needs valid site