removed new user creation from Devise, added authenticate_user to controllers to force login