renamed delete action to destroy; and added some basic authentication checks inside the controllers