fixed: requre all controllers authenticate user