Remove session[:user] = @user to avoid cache/security issues.