api.rb

  def unsubscribe
    # using base64 encoding in the url to prevent unsubscribe abuse
    @user = User.find_by_access_token(Base64.decode64(params[:token])) # find the user from the ID in url
    if @user.opt_out!
      redirect_to root_url, :notice => "We won't bug you with emails!"  # give them a little notice that it worked
    else
      render :text => "Could not find your access token, did you copy-paste the correct email from the unsubscribe?  Just email us at blah2blah.com"
    end
  end


# in the model app/models/user.rb
  def opt_out!
    update_attributes(:opt_out => true)
  end