add authorize User to index controller