I'm at a loss trying to figure out why my Rails auth pipeline only hits `new` and not `create`. This causes the login page to re-render and never go to a `search` page. Would you have a look at my code to see what I might be overlooking?

I am using `bcrypt` to hash password attribute in `user`

My `routes` 

```
Rails.application.routes.draw do
  root :to => "searches#search" 

  resources :users, only: [:show, :new, :create, :destroy]

  get '/login', to: 'sessions#new', as: 'login'
  post '/login', to: 'sessions#create'

  delete '/logout', to: 'sessions#destroy', as: 'logout'

  get 'searches/index' => "searches#index"
  get 'searches/show' => "searches#show"
  get 'searches/search' => "searches#search" 

  get 'audits/show' => 'audits#show'     
  get 'audits/download' => 'downloads#show' 
  post 'audits/' => 'audits#create'

  # For details on the DSL available within this file, see https://guides.rubyonrails.org/routing.html
end 

```

`application_controller` 

```
class ApplicationController < ActionController::Base
  before_action :authorized #lock down this whole app
  helper_method :current_user #i can call current_user from a view

  def current_user
    User.find_by({ id: session[:user_id] })
  end

  def logged_in?
    !!current_user
  end

  def authorized
    redirect_to login_path unless logged_in?
  end

end

```

`sessions_controller`

```
class SessionsController < ApplicationController
  skip_before_action :authorized, only: [:new, :create]

  def new
  end

  def create
    #handles the POST request to /login
    @user = User.find_by(username: params[:username])
    if @user && @user.authenticate(params[:password])
      session[:user_id] = @user.id
      redirect_to @user
    else
      flash[:notice] = 'Invalid username or password'
      redirect_to login_path
    end
  end

  def destroy
    session.delete(:user_id)
    flash[:notice] = 'logged out'
    redirect_to login_path
  end

end

```

and the login form in `sessions/new.html.erb` 

```

<div class='login'>
    <div class="login-form">
        <form>
            <div class="form-group">
                <%= form_with url: login_path, method: 'post', local: true do |f|  %>
                    <%= f.label :username,  "Username", class: "col-md-4 control-label" %>
                    <%= f.text_field :username, class: "form-control", required: true %>
                    <%= f.label :password,  "Password", class: "col-md-4 control-label" %>
                    <%= f.password_field :password, class: "form-control", required: true %>
                    <%= f.submit "Login", class: "btn btn-default btn-primary" %>
                <% end %>
            </div>

        </form>
    </div>
</div>

```

I have tried `form_tag` as well but same issue. I made the method explicit just to be sure even though it shouldn't be necessary.