menu.erb accessible only to logged-in users