built in session middleware, user must provide a secret key in settings.rb
Documentation about the project template (authentication and initializers directory)