add authenticate_user before_action to ensure only logged users can use most CRUD