add checks to make sure user only views their own content
change before_filter to before_action