moved before_action :authenticate_user! to Application controller to force user login before any actions can be taken (even from index)