Use devise for auth

incomplete pull request