added before_filter to check for user authentication