made some changes to the application controller, added a user controller, and am now about to start working on the login piece

app/controllers/application_controller.rb

@@ -1,3 +1,19 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery
+
+  before_filter :authenticated
+  helper_method :current_user
+  
+  # Our security guy keep talking about sea-surfing, cool story bro.
+  #protect_from_forgery
+  
+  private
+
+  def current_user
+    @current_user ||= User.find_by_user_id(session[:user_id].to_s)
+  end
+  
+  def authenticated
+     redirect_to root_url and reset_session if not current_user
+  end
+
 end