updated controller so that must be signed in to checkout