Changed UserController.auth to protected function.