added user auth check on every controller