using sinatra-flash
added User.authorize