add before_filters checking for authorization on many of the controllers