Rails authentication not reacting to wrong username or password - ruby-on-rails

Question

I am building a rails app that requires a log in. I have only one user set up and anytime I enter an incorrect user or password, it does nothing but appends "utf8=✓&authenticity_token=TnSbSndhlfVfO6VLpeGLWgkCdrcXvMFD6gUVyCRax64%3D&email=&password=&commit=Submit" to the URL. I have it set up to say "Invalid username or password" but it's doing nothing. I need it to authenticate and direct the user to the next page. It's not taking me to the next page with the correct username and password either. It just appends that string to the URL and does nothing else. I am new to this so apologies if I'm not being clear enough. Here's my code:
user.rb
class User < ActiveRecord::Base
attr_accessible :email, :password, :password_confirmation
attr_accessor :password
before_save :encrypt_password
validates_confirmation_of :password
validates_presence_of :password, :on => :create
validates_presence_of :email
validates_uniqueness_of :email
def self.authenticate(email, password)
user = find_by_email(email)
if user && user.password_hash == BCrypt::Engine.hash_secret(password, user.password_salt)
user
else
nil
end
end
def encrypt_password
if password.present?
self.password_salt = BCrypt::Engine.generate_salt
self.password_hash = BCrypt::Engine.hash_secret(password, password_salt)
end
end
end
appplication_controller.rb
class ApplicationController < ActionController::Base
protect_from_forgery with: :exception
helper_method :current_user
before_filter :require_login
def current_user
#current_user ||= User.find(session[:user_id]) if session[:user_id]
end
def require_login
unless current_user
redirect_to log_in_path, :notice => "Please log in to access this page."
end
end
end
sessions_controller.rb
class SessionsController < ApplicationController
skip_before_filter :require_login
def new
end
def create
user = User.authenticate(params[:email], params[:password])
if user
session[:user_id] = user_id
redirect_to stats_path, :notice => "Welcome"
else
flash.now.alert = "Invalid email or password"
render "new"
end
end
def destroy
session[:user_id] = nil
redirect_to root_url, :notice => "Logged out"
end
end
form view html
<h2 class="form-signin-heading">Log In</h2>
<form class="form-signin">
<%= form_tag sessions_path do %>
<% flash.each do |name, msg| %>
<%= content_tag :div, msg, class: name %>
<% end %>
<%= text_field_tag :email, params[:email], :placeholder => "Email address", :class => "form-control" %><br />
<%= password_field_tag :password, params[:password], :placeholder => "Password", :class => "form-control" %><br />
<%= submit_tag "Submit", :class => "btn btn-lg btn-primary btn-block" %>
<% end %>
</form>

Answer 1

You seem to be missing the ERB in your view to display the flash message. Example:
<% flash.each do |name, msg| -%>
<%= content_tag :div, msg, class: name %>
<% end -%>
See this rails guide for more details...