add authenticate_user! to controllers