refactor controllers to use before_filter