require authentication before certain goal controller actions