added router beforeAction to ensure logged in user p236