9.0 Security

If you were to publish your blog online, anybody would be able to add,
edit and delete posts or delete comments.

Rails provides a very simple HTTP authentication system that will work
nicely in this situation.

In the PostsController we need to have a way to block access to the
various actions if the person is not authenticated, here we can use the
Rails http_basic_authenticate_with method, allowing access to the
requested action if that method allows it.

To use the authentication system, we specify it at the top of our
PostsController, in this case, we want the user to be authenticated on
every action, except for index and show,