some of the controller actions were restricted for visitors