Finish securing SubmissionsController.

This closes #13.