made some changes to the application controller, added a user controller, and am now about to start working on the login piece

app/controllers/application_controller.rb

@@ -1,3 +1,19 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery
+
+  before_filter :authenticated
+  helper_method :current_user
+  
+  # Our security guy keep talking about sea-surfing, cool story bro.
+  #protect_from_forgery
+  
+  private
+
+  def current_user
+    @current_user ||= User.find_by_user_id(session[:user_id].to_s)
+  end
+  
+  def authenticated
+     redirect_to root_url and reset_session if not current_user
+  end
+
 end

app/controllers/sessions_controller.rb

@@ -1,5 +1,7 @@
 class SessionsController < ApplicationController
-
+  
+  skip_before_filter :authenticated, :only => [:new]
+  
   def new
   end
 

app/controllers/users_controller.rb

@@ -0,0 +1,4 @@
+class UsersController < ApplicationController
+  def new
+  end
+end