add authorize before_filter for Users controller