add before actions for authorization
add empty current_user? method
add more authorization specs