Changed to have controllers secured by default