changed before action to force return true so routes can not be directly accessed (adds auth layer to controller)