not safe. use devise for users: https://github.com/plataformatec/devise