do not expose user index and view actions to not authenticated users (be more paranoid by default)