Move the capabilities call out of api_controller