app is now a protected property of controller