Implement security more consistently

push functionality to base controllers if possible

(from redmine: issue id 443, created on 2018-01-22tgradl)