added authentication to settings controller