clean up person controller and improve permissions