# deny direct access to controller 
deny from all