fixed controller do private method only applies to logged in users