authentication for controllers
current_user crap fixed