Require auth for all controller actions except show
Remove unused action