Add before_action requiring login to see app