implement user authentication on controller actions