Move access control from model to controller.