All requests should go through a controller