add before filter to check user logged in