Add before_action :authenticate_user! to app controller