added a before filter to ensure logged in for all actions