Controller

• Do as little as possible
• Call method based on URL
• Get data from the user
• minimal access control, etc.

NOTHING ELSE