lock down notifications_controller with devise