added user authentication (devise)