require authenticated user on created controllers