add require_user method to application_controller.rb