add authentication via devise