use before_actions for member and admin authorization