does `authenticate_person!` check that a user is logged in? I'd guess that this is implicitly handles in check_role. Also weird, both apply to the same actions byt one uses except, the other only