Added before_action to ensure user is authenticated with token

@doomspork if this looks good feel free to merge