added before_action to redirect if user not logged in