Added: authenticate user before actions