Added before_action to ensure user is authenticated with token