perhaps @current_user hasn't been defined yet (due to before_action). So, lets define it ourselves, then run the if statment to redirect if not authenticated on protected pages.