require login before accessing user
remove before_filter in users and rename method