Exercise 8.5.1: Refactor app/views/sessions/new.html.erb to use 'form_tag' in place of 'form_for'

Note in particular the change in the structure of the 'params' hash
In practice, comment out all in SessionsController#create and insert one single line "render 'new'", then click signin to see the form params hash structure
Exercies 8.5.2: Add test methods using RSpec custom matcher & helper method
Further decouple the tests from implementation
Updating users: Add failing tests for the user edit page
Updating users: Define the UsersController#edit action
Updating users: Add the app/views/users/edit.html.erb view

Pay attention to how closely the edit form resembles the new user view form
Actually according to the API doc of 'form_for', if the user is new, rails will generate a form POST to /users; and if the user contains data, rails will generate a form PATCH to /users/<id>
Updating users: Adding a failing test for the “Settings” (edit user) link if user is signed-in
Updating users: A test helper ('sign_in') to sign users in
Updating users: Adding a “Settings” link to the drop down menu
Unsuccessful edits: The initial user 'update' action
Now the test cases all pass
But successful update is not implemented
Successful edits: Add failing tests for the user update action
Successful edits: Complete the user update action and get all tests pass
Authorization - Requiring signed-in users: Add failing test case that edit & update actions are protected against un-signed-in users

Techniques used:
1. Direct PATCH to url, 'patch user_path(user)'
2. Verify the low-level http response, 'expect(response).to redirect_to(signin_path)'

Authorization is different from authentication
authentication allows us to identify users of our site, and authorization lets us control what they can do
Authorization - Requiring signed-in users: Force the user to signin before call to user actions 'edit' or 'update' (UsersController#edit and #update) by adding a 'before_action'. For non-signed-in users redirect them to the signin page
Authorization - Requiring the right user: Add failing test that the edit and update actions require the right user

Techniques:
Passing optional parameters to FactoryGirl 'FactoryGirl.create(:user, email: "wrong@example.com")'
Authorization - Requiring the right user: Add a 2nd before filter to force that while trying to editing some user (call edit on url such as /users/6/edit, or PATCH to /users/6), the request user equals to current signed-in user
Friendly forwarding: A failing test that visit edit page, then signin, then verify the page is edit instead of read only
Friendly forwarding: Implement friendly forwarding using session to store/recover the request url
Merge branch 'chapter8-exercise' into updating-users

Conflicts:
	spec/support/utilities.rb
Showing all users: A failing test that user index action is protected against un-signed-in users
Showing all users: Get the test pass by requiring a signed-in user for the index action