I am guessing this is fine, but its curious that this is the only controller I can find in app/ which is calling authenticate_user! .