Authorization from scratch, railscast 250