assets
redirect to back instead of root on no-auth
tighter table in user#show