https://github.com/projecthydra/hydra-head/blob/f3da6a134e61b64e79d229d124de4e49cb686831/hydra-core/app/controllers/concerns/hydra/controller/controller_behavior.rb#L31 Perhaps we need to override deny_access on the RecordsController?
