add before_actions, define requre_ownership