securing resource controllers if user defined