Ruby : Broken authentication and session management