require_authorization now redirect to root_url instead of returning forbidden head