added true to the default of controllers so they must be authenticated first
now it's set to true