User Verification, no cats and more

You also want to protect the `create` action from unauthenticated users. I can bypass the `new` action by submitting a POST request directly to the server.