before_filter to restrict updates to logged in users