added before-filter to limit access to actions