added require_user to roster controller