auth from scratch following railscast 250