implemented public authenticator for dev purposes + added auth restrictions to all actions (except api actions)