add authenticate_user before_action