Controller is not protected from anonymous users
Closes #1