added restrictions in controllers