before filter on every controller--- user athentication