resolves #5, auth checks moved to beforeAction