Associate users and articles; require login to post

Resolves #12.
Yeah a whitelist would be good here, updated my example code. And it looks like you don't need to have that method in app_controller but maybe in the future you do so just keep an eye out for the need to reuse that in another controller.