Add auth_only method for User controller actions