fix accountcontroller access rights on some methods