protected_controller.rb

class ProtectedController << ApplicationController
  before_filter :force_user
  
  def index
  end
private
  def force_user
    unless session[:user_id]
      session[:redirect_url] = request.fullpath
      redirect_to new_sessions_path
    end
  end
end

session_controller.rb

class SessionsController << ApplicationController
  def create
    session[:user_id] = User.first.id
    redirect_to session[:redirect_url] ? session[:redirect_to] : root_path
  end
end