fixed security issue and updated to provide user and context id to controllers