add authentication checks in ApplicationController