change Get to Post
fix methods names to require devise authentication