protection with before_filters
post controller in dummy