Add before_action require_auth to challenges_controller