Updated user controller to block Show to users not signed in

Users were able to access Show.html using URL manipulation, now they get
redirected to Sign In page.