devise done, top objects auth-protected