base_controller.rb

class ApplicationController < ActionController::Base
  include UserAuthentication
end

reimb_controller.rb

# controllers/vulcan/reimbursements_controller.rb

class Vulcan::ReimbursementsController < AdminController
  before_action :reconfirm_password, only: %w(index)

  def index
    # Get all reimbursements and associated users with minimal queries possible
    @reimbursements = Reimbursement.includes( :user )

    # Create new object
    @reimbursement = Reimbursement.new
  end
end

sessions_controller.rb

class UserSessionsController < ApplicationController
  def new
    render :new
  end

  # Create a new user session
  def create
    # Find the user by the email parameter which is passed in (via params)
    user = User.find_by( email: params[ :email ] )

    if authenticated?
      session[:user_session_id] = current_session.id
      flash[ :success ] = "You have signed in as '#{current_user.email}'"
    else
      flash[ :error ] = "Incorrect username or password."
    end
    
    redirect_to :back
  end

  # Destroy a user session
  def destroy
    current_session.try(:destroy) && redirect_to(:back)
  end

end

user_authentication.rb

# controllers/concerns/password_reconfirmation.rb

module PasswordReconfirmation\
  def authenticated?
    current_user.try(:authenticate, params[:password])
  end
  
  def current_user
    current_session.try(:user) || User.find_by_email(params[:email])
  end
  
  def current_session
    UserSession.find session[:user_session_id]
  end

  # Let's reconfirm the users password before we let them continue
  def reconfirm_password
    unless current_user.try(:authenticate, params[:password])
      flash[:error] = "Password reconfirmation failed. Please enter the correct password for this user."
      redirect_to :back and return
    end
  end
end