Didn't we add a before_filter authenticate_company! on this?