forced user authen in app controller