set before_filter :require_login