Use a before filter for authorization