fixed: redirect does not require authentication, and before_filter to before_action