add access control to backend

backend/controllers/UserController.php

@@ -29,6 +29,18 @@ class UserController extends Controller
                     'delete' => ['post'],
                 ],
             ],
+        		'access' => [
+        				'class' => \yii\filters\AccessControl::className(),
+        				'only' => [   'index', 'create','update','view'],
+        				'rules' => [
+        						// allow authenticated users
+        						[
+        								'allow' => true,
+        								'roles' => ['@'],
+        						],
+        						// everything else is denied
+        				],
+        		],
         ];
     }