add before_action for authenticate