changed authentication always to go through devise