simple API security

gistfile1.rb

  before_filter :restrict_access
  
  protected
  
  def restrict_access   
    if Rails.env != "development"
      access_token = request.headers['access_token']
      access_token ||= params[:access_token]
      begin
        @auth = Authorization.find_by_access_token(access_token)     
        head :unauthorized unless @auth
      rescue ActiveRecord::RecordNotFound => e
        head :unauthorized 
      end
    end     
  end