I think we need to add before_action here for proper authentication