access_controller

def attempt_login
  authorized_user = User.authenticate(params[:username], params[:hashed_password])
  unless authorized_user.eql?(false)
    session[:user_id] = authorized_user.id
    session[:username] = authorized_user.username
    case authorized_user.account_type
      when "admin"
        redirect_to :action => "index"
      when "it"
        redirect_to :action => "it"
    end
  else
    #flash something for the error
    redirect_to root_url #or somewhere else
  end
end

user model

def self.authenticate(username="",password="")
	user = User.find_by_username(username)
	
	#can hashed_password be matched with the input password?
	if user && user.hashed_password == password
		user
	else
		false
	end
end