Restrict controller access, refactor tests.