sample_sessions_controller.rb

class SessionsController < ApplicationController

  expose(:login_form) { LoginForm.new }

  def create
    user = User.find_by_email(params[:email])
    if user && user.authenticate(params[:password])
      reset_session
      if params[:remember_me]
        cookies.permanent[:auth_token] = user.auth_token
      else
        cookies[:auth_token] = user.auth_token
      end
      redirect_to user, notice: "Signed in!"
    else
      flash[:error] = "Email or password is invalid."
      redirect_to login_path
    end
  end

  def destroy
    cookies.delete(:auth_token)
    redirect_to root_url, notice: "Signed out!"
  end

  def new; end

end