change to use devise gem for user security