add no access spec for class controller