Test

def auth
  user = find_by_email(email)
    if user && user.password_hash == BCrypt::Engine.hash_secret(password, user.password_salt)
      user
  else
    render json: { errors: ["wrong username or password"] }, status: :unauthorized
  end
end