working routes with before_filter authenticating user