Step 15: restrict access to actions with before_action filter