add before_action authentication