Added: role user, before_action: authenticate him