def create
    user = User.find_by_username(params[:username])
    if user && user.authenticate(params[:password])
      session[:user_id] = user.id
      flash[:notice] = "Logged in"

      redirect_to ( params[:redirect_for] ||= root_path )
    else
      flash[:error] = "Invalid username or password"
      render :new
    end
  end