title: Rails Way to Restrict Page Access Without Sessions
body: <p><strong>Context</strong></p>
  
  <p>I'm building a super simple, knock-your-socks-off sexy sign-up page at <a href="http://hivechatter.com" rel="nofollow">http://hivechatter.com</a>.  (Yes, I feel strongly about her.)</p>
  
  <p>The root page is the new user action, where I ask for email only.  If the visitor submits a valid email, a new user is created and I redirect to that user's edit page and ask for additional, optional info.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>The edit page url is of the usual form: <a href="http://hivechatter.com/users/19/edit" rel="nofollow">http://hivechatter.com/users/19/edit</a>.  One can visit any user's edit page by simply visiting this url with whichever id number they choose.</p>
  
  <p><strong>Question</strong></p>
  
  <p>How do I restrict access to the edit user page so that it can only be visited once, and only immediately after having created that user_id from the root new user page?</p>
  
  <p>I can think of a variety of methods to explore.  I'd appreciate a pointer on the most elegant, rails way to do this.  Note that I don't need any additional functionality like sessions, etc.  This two step sign-up process is the extent of what I need right now.</p>
  
  <p>Thanks!</p>