set up proper security using before_action and require_user_session appl...

...ication method