rail blog with auth done from scratch