restricted access to most of the controllers actions by login
  added before_action hook to ApplicationController
  added skip_before_action for some actions (whitelisting)
  fixed specs using shared context
added 'Who bought this' to product#show using partial for order
added more meaningful links to side panel