add access-filter :check_access in app/controllers/application_controller.rb