removed before_action authenticate_user