add_user.rhtml
<div class="depot-form">

  <%= error_messages_for 'user' %>

  <fieldset>
    <legend>Enter User Details</legend>

    <% form_for :user do |form| %>

      <p>
        <label for="name">Name:</label>
        <%= form.text_field :name, :size => 40 %>
      </p>

      <p>
         <label for="order_address">Address:</label>
         <%= form.text_area :address, :rows => 3, :cols => 40 %>
      </p>

      <p>
        <label for="order_email">E-Mail:</label>
        <%= form.text_field :email, :size => 40 %>
      </p>

      <p>
        <label for="username">Username:</label>
        <%= form.text_field :username, :size => 40 %>
      </p>
      <p>
        <label for="user_password">Password:</label>
        <%= form.password_field :password, :size => 40 %>
      </p>

      <p>
        <label for="user_password_confirmation">Confirm:</label>
        <%= form.password_field :password_confirmation, :size => 40 %>
      </p>

      <%= submit_tag "Add User", :class => "submit" %>

    <% end %>
  </fieldset>
</div>

login_controller.rb

#method for logging in
  def login
    session[:user_id] = nil
    if request.post?
      user = User.authenticate(params[:username], params[:password])
      if user
        session[:user_id] = user.id
        session[:name] = user.name
        session[:address] = user.address
        session[:email] = user.email
        session[:accesslevel] = user.accesslevel
        session[:username] = user.username
        redirect_to(:controller => 'store', :action => 'index')
      else
        flash[:notice] = "Invalid user/password combination"
      end
    end
  end

user.rb

def self.authenticate(username, password)
    user = self.find_by_name(username)
    if user
      expected_password = encrypted_password(password)
      if user.hashed_password != expected_password
        user = nil
      end
    end
    user
  end