How about if curr_user.password == params[:password] , they get logged in, else login fails?  This way the else case is not logging someone in.