Make sure show action requires authentication, too