Added auth protection to private actions on front end