added authorization to index and show actions