The authorization application code uses a before filter, which arranges for a particular method to be called before the given actions. To require users to be signed in, we define a signed_in_user method and invoke it using before_filter :signed_in_user, as shown in Listing 9.12.

By default, before filters apply to every action in a controller, so here we restrict the filter to act only on the :edit and :update actions by passing the appropriate :only options hash. Note that Listing 9.12 uses a shortcut for setting flash[:notice] by passing an options hash to the redirect_to function. The code in Listing 9.12 is equivalent to the more verbose

(The same construction works for the :error key, but not for :success.)

      Together with :success and :error, the :notice key completes our triumvirate of flash styles, all of which are supported natively by Bootstrap CSS. By signing out and attempting to access the user edit page /users/1/edit, we can see the resulting yellow ‘‘notice’’ box, as seen in Figure 9.6.  

         Figure 9.6 The signin form after trying to access a protected page.