tiny ROR app with authorization