trying to add security to controllers