added shoulda
added `inherited_resources`
devise: server side auth API