cleaned up imports
protected all actions of controller to be not accessible by anonymous