fixed routes while nesting, updated controllers, fixed devise user authenticate