authenticate_user! for habitat and species controllers