more authentication work, added log in check to application controller