title: Require old password to change new password authlogic authentication
body: <p>I have a _form.html.erb partial that will send user input to the update method in the controller</p>
  
  <pre><code>&lt;div id='myaccount-profile_name_form' class='clearfix'&gt;
    &lt;fieldset id="myaccount-profile" class='five columns'&gt;
       &lt;ul id="posting_classified_form"&gt;
         &lt;li&gt;
           &lt;%= f.label :first_name %&gt;
           &lt;%= f.text_field :first_name, :placeholder =&gt; "First Name" %&gt;
          &lt;/li&gt;
          &lt;li&gt;
            &lt;%= f.label :last_name %&gt;
            &lt;%= f.text_field :last_name %&gt;
          &lt;/li&gt;
          &lt;li&gt;
            &lt;%= f.label :email %&gt;
            &lt;%= f.text_field :email %&gt;
          &lt;/li&gt;
          &lt;li&gt;
            &lt;%= f.label :form_birth_date, "Birthday" %&gt;
            &lt;%= f.text_field :form_birth_date, :class =&gt; 'ui-yearpicker', :placeholder =&gt; "mm/dd/yyyy" %&gt;
          &lt;/li&gt;
       &lt;/ul&gt;
    &lt;/fieldset&gt;
  &lt;/div&gt;
  &lt;div id='myaccount-profile_form' class='clearfix' &gt;
    &lt;fieldset id="myaccount-profile-password" class='five '&gt;
      &lt;ul id="posting_classified_form"&gt;
        &lt;li&gt;
          &lt;%= f.label :current_password, "Current Password", :placeholder =&gt; "We need your current password to confirm your changes", :required =&gt; true %&gt;
          &lt;%= f.password_field :password %&gt;
        &lt;/li&gt;
        &lt;li&gt;
          &lt;%= f.label :password, "New Password" %&gt;
          &lt;%= f.password_field :password %&gt;
        &lt;/li&gt;
        &lt;li&gt;
          &lt;%= f.label :password_confirmation, "Confirm", :style =&gt; "white-space:normal;" %&gt;
          &lt;%= f.password_field :password_confirmation %&gt;
        &lt;/li&gt;
      &lt;/ul&gt;
    &lt;/fieldset&gt;
    &lt;div class="actions"&gt;&lt;%= f.submit 'Update' , :class =&gt; 'goButton', :style =&gt; 'width:auto;float:right;'%&gt;&lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>this is the edit/update methods in the controller</p>
  
  <pre><code>  def edit
      @user = current_user
    end
  
    def update
      @user = current_user
      if @user.valid_password?(params[:user][:current_password])
        binding.pry
        @user.update_attributes(params[:user])
        flash[:notice]  = "Successfully updated user."
        redirect_to umarket_index_url
      else
        flash[:notice]  = "An error occurred while updating user please try again."
        redirect_to umarket_index_url
   #     render :edit
      end
    end 
  </code></pre>
  
  <p>We are using the authlogic gem to do authentication. I found valid_password? from authlogic doc. I want to give the user the ability to change password only after the user enters the correct password. </p>
  
  <p>The server logs look like this</p>
  
  <pre><code>Started GET "/myaccount/overview/edit" for 127.0.0.1 at 2014-07-03 11:16:07 -0400
  Processing by Myaccount::OverviewsController#edit as HTML
    User Load (0.5ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 6 LIMIT 1
    Rendered myaccount/overviews/_form.html.erb (2.7ms)
    Rendered myaccount/overviews/edit.html.erb (5.3ms)
  Completed 200 OK in 16ms (Views: 5.9ms | ActiveRecord: 0.5ms)
  
  
  Started PUT "/myaccount/overview" for 127.0.0.1 at 2014-07-03 11:16:14 -0400
  Processing by Myaccount::OverviewsController#update as HTML
    Parameters: {"utf8"=&gt;"✓", "authenticity_token"=&gt;"b01gMlAQOJpu6Zu+mg+M4v2VYfm0AZvTAfKXa+ArJxU=", "user"=&gt;{"first_name"=&gt;"Judy", "last_name"=&gt;"Ngai", "email"=&gt;"judy.ngai1228@gmail.com", "form_birth_date"=&gt;"spree@example.com", "password"=&gt;"[FILTERED]", "password_confirmation"=&gt;"[FILTERED]"}, "commit"=&gt;"Update"}
    User Load (0.6ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 6 LIMIT 1
  Redirected to http://localhost:3000/umarket
  Completed 302 Found in 15ms (ActiveRecord: 0.6ms)
  </code></pre>
  
  <p>The password didn't get change. There are no errors from the logs. I don't use authlogic so I am quite confused. </p>