1. before filter 驗證登入 (補測試)
2. 用 current_user.petitions 去 find or new