title: Editing/Updating user not working when using has_secure_password in Rails 4
body: <p>I am using Michael Hartl's <a href="http://ruby.railstutorial.org/chapters/updating-showing-and-deleting-users#sec-updating_users" rel="nofollow">Ruby on Rails tutorial</a> to make my own user auth system. Everything is working fine when creating a new user. When trying to update a user is when things are no longer making sense. I am using the <code>has_secure_password</code> method. So I let it worry about taking the password and encrypting it. But when I update, some weird behavior occurs.</p>
  
  <p>The important part is that I can update a user without entering any password and its confirmation. But if I enter a password and no confirmation, it requires a confirmation. If I only enter a confirmation password, that updates with no error. Now since <code>has_secure_paassword</code> is suppose to be doing that part, why is it not doing it when updating? One thing I did not add in my User model is a presence validation due to this line in the tutorial:</p>
  
  <blockquote>
    <p>Presence validations for the password and its confirmation are
    automatically added by has_secure_password.</p>
  </blockquote>
  
  <p>I am aware that there are similar questions on this, but none seem to enforce strong parameters, which is my guess as to why it is not working for me. Some of my code below.</p>
  
  <p><strong>User Controller</strong></p>
  
  <pre><code>def edit
      @user = User.find(params[:id])
  end
  
  def update
      @user = User.find(params[:id])
  
      # if params[:user][:password].blank?
      #   render 'edit'
      #   return
      # end
  
      if @user.update(user_params)
          redirect_to @user, notice: 'User successfully updated'
      else
          render 'edit', notice: 'Failed to update profile.'
      end
  end
  def user_params
      params.require(:user).permit(
          :username, :email, :phone, :bio, :password, :password_confirmation
          )
  end
  </code></pre>
  
  <p><strong>User model</strong></p>
  
  <pre><code>class User &lt; ActiveRecord::Base
  
    before_save {self.email = email.downcase}
    has_secure_password
    before_create :create_remember_token
  
    validates :username, presence: true, length: {maximum: 255, minimum: 5},
    format: { with: /\A[a-zA-Z0-9]*\z/, message: "may only contain letters and numbers." },
    uniqueness: true
  
    VALID_EMAIL_REGEX = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
    validates :email, presence: true, format: { with: VALID_EMAIL_REGEX }
    #... Other User stuff.
  </code></pre>
  
  <p><strong>Edit form</strong></p>
  
  <pre><code>&lt;div class="col-xs-8 col-xs-offset-2"&gt;
    &lt;%= form_for(@user, :html =&gt; {:class =&gt; 'well'}) do |f| %&gt;
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :username %&gt;&lt;br /&gt;
        &lt;%= f.text_field :username, class: 'form-control' %&gt;
      &lt;/div&gt;
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :phone %&gt;&lt;br /&gt;
        &lt;%= f.phone_field :phone, class: 'form-control' %&gt;
      &lt;/div&gt;
  
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :bio %&gt;&lt;br /&gt;
        &lt;%= f.text_area :bio, class: 'form-control' %&gt; 
      &lt;/div&gt;
  
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :email %&gt;&lt;br /&gt;
        &lt;%= f.email_field :email, class: 'form-control' %&gt;
      &lt;/div&gt;
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :password %&gt;&lt;br /&gt;
        &lt;%= f.password_field :password, class: 'form-control' %&gt;
      &lt;/div&gt;
  
      &lt;div class="form-group"&gt;
        &lt;%= f.label :password_confirmation %&gt;&lt;br /&gt;
        &lt;%= f.password_field :password_confirmation, class: 'form-control' %&gt;
      &lt;/div&gt;
  
      &lt;div class="form-group"&gt;
        &lt;%= f.submit "Update", class: 'btn btn-default' %&gt;
      &lt;/div&gt;
    &lt;% end %&gt;
  
  &lt;/div&gt;
  </code></pre>