Prevent direct access of controller