this should be in a before_filter :authenticate_user!