add a handler to prevent calling a protected or private controller method