add before_filter: authenticate_user! in posts_controller.rb