refactored to remove devise and do authentication from scratch