security working.. but still in controllers