use authenticate_user! as a before filter