It was used as a kind of access control check, but it's clearer if the check is in the only controller that actually needs it.