fixed first controller to require authentication, playing with static rules in config.groovy