you could throw in a before filter here to ensure that the user is logged in otherwise they can't even hit the new action