require authentication for 'foods' controller