@@state_secret

[ronald.evangelista]

would be great to do something simple like that for authenticating 
controller methods.
been using something like this to authenticate get and post in one sweep.

    module Controllers
        module AuthenticationHelper
            def self.included(base)
                base.module_eval do
                    def get(*a)
                    end  unless method_defined? :get
                    def post(*a)
                    end unless method_defined? :post

                    alias_method :__post__, :post
                    alias_method :__get__ , :get

                    def get(*args)
                        on_authenticated do
                            __get__(*args)
                        end
                    end
                    def post(*args)
                        on_authenticated do
                            __post__(*args)
                        end
                    end
                end
            end
            private
            def on_authenticated
                unless @state.blank? or @state.user_id.nil?
                    yield
                else
                    @state.link_back=@env.REQUEST_URI
                    redirect(Login)
                end
            end
        end
    end

  # included at the end
class Add
    def get;end
    def post;end
    include AuthenticationHelper
end