Applied Sessions and restricting access with before_action