only allow authorized users

only authorize from facebook for existing users
redirect all users to sign_in page unless they are signed in
Fix welcome controller spec