require authentication for everything except show and index