I think this is where a clean devise integration would help. It would also be helpful to put the login functionality in a "sessions_controller", since restfully, that's what's it's doing, creating (login) and destroying (logout) sessions. Then the users_controller deals with the user CRUD stuff. Also, those kinds of before_action callbacks that can be used everywhere should probably be placed in the main application_controller.