disabling protection in Application Controller