access show.js but not any other views unless user authenticated