update controller to be protected