When I log in from a form post to session/create there's a call to
User.authenticate (which in turn puts a :user variable in the session
from the self.current_user call.

My issue is when I call self.current_user = User.authenticate(...)
from somewhere else and I redirect.. I lose my session variable. How
could this happen?

Maybe somewhere has the code “reset_session”
or “session[:user] = nil”