added some authorization, user can now view homepage and show page without logging in