added user authentication before controller actions