title: In Rails, where do I stop access to New, Update, etc if the user is not logged in?
body: <p>I've got a view for entering / editing posts.</p>
  
  <p>I want to stop people from creating or editing posts if they are not logged in (in the model) &amp; I want to redirect the ./posts/new view to the posts list with a "You cannot create new posts if you're not logged in" message.</p>
  
  <p>I've tried changing the "new" command in the posts controller as so:</p>
  
  <pre><code>  def new
  
      if !session[:user] 
        redirect_to(@posts, :notice =&gt; 'You cannot create a post unless you are logged in.')
        return
      end
  
      @post = Post.new
  
      respond_to do |format|
        format.html # new.html.erb
        format.xml  { render :xml =&gt; @post }
      end
    end
  </code></pre>
  
  <p>but that doesn't work.</p>
  
  <p>I don't know if I should put the logic for what I want to do in the controller, in the view or in the model. (Or some combination of all 3).</p>
  
  <p>I'm guessing that I should only be putting it in one place (DRY, etc), but I don't know where. </p>