add before_action :require_login