8.1.1 Sessions Controller

The elements of signing in and out correspond to particular REST actions
of the Sessions controller: the signin form is handled by the new action
(covered in this section), actually signing in is handled by sending a
POST request to the create action (Section 8.1 and Section 8.2), and
signing out is handled by sending a DELETE request to the destroy action
(Section 8.2.6). (Recall the association of HTTP verbs with REST actions
from Table 7.8.) To get started, we’ll generate a Sessions controller
and an integration test for the authentication machinery:
8.1.3 Signin form

With our tests in place, we’re ready to start developing the signin
form. Recall from Listing 7.17 that the signup form uses the form_for
helper, taking as an argument the user instance variable @user:

<%= form_for(@user) do |f| %>
  .
  .
  .
<% end %>

The main difference between this and the signup form is that we have no
Session model, and hence no analogue for the @user variable. This means
that, in constructing the new session form, we have to give form_for
slightly more information; in particular, whereas

form_for(@user)

allows Rails to infer that the action of the form should be to POST to
the URL /users, in the case of sessions we need to indicate the name of
the resource and the corresponding URL:

form_for(:session, url: sessions_path)