sample rails authentication code, without using pre-built authentication gems