added user auth before action to controllers