security access control is not enforced on custom controllers

[Loiklak]

But the 'security' annotation works so I think it would be a good idea to enforce it