title: Devise: allow users to reset password only
body: <p>I've got a pretty standard <code>User</code> model with Devise. Administrators are controlled with an <code>:admin</code> boolean on the model, and users who aren't administrators cannot manage themselves (i.e., only administrators can make changes to users).</p>
  
  <p>What I'd like is to permit users to reset their password if they forget it. They would enter their email address then be emailed a token which would grant them access to change it. I've started a solution but I really don't know how to proceed.</p>
  
  <p><strong>user.rb</strong></p>
  
  <pre><code>class User &lt; ActiveRecord::Base
    devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable
    attr_accessor :current_password
    attr_accessible :name, :password, :password_confirmation, :current_password, :email, :remember_me, :ftp, :colour1, :colour2, :logo, :logo2, :address, :url, :disclosure, :general_advice, :facebook, :twitter, :brand_id, :analytics
    attr_protected :admin
    validates_uniqueness_of :email, :ftp
    belongs_to :brand
    has_many :docs
    has_many :orders, :through =&gt; :docs
    has_attached_file :logo
    has_attached_file :logo2
  end
  
  class Ability
    include CanCan::Ability
    def initialize(user)
      user ||= User.new #guesting
      if user.admin?
        can :manage, :all
      else
        can :manage, :recoverable
      end
    end
  end
  </code></pre>
  
  <p>And here's the method:</p>
  
  <pre><code>def reset
    @idiot = User.where(:email =&gt; params[:email]).first
      unless @idiot.nil?
        Notifier.send_reset_notice(@idiot).deliver
        @idiot.send_reset_password_instructions
        redirect_to new_user_session_url
      else
        redirect_to new_user_session_url, :flash =&gt; { :error =&gt; "That email address matches no user." }
      end
  end
  </code></pre>
  
  <p>The user receives the Devise email but clicking on the link takes the user to the application root and not to a password reset form. I'm not sure how to proceed from here. Any thoughts? Cheers!</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Relevant routes:</p>
  
  <pre><code>devise_for :users, :path =&gt; "d"
  devise_scope :user do
    get '/sign_in' =&gt; 'devise/sessions#new'
    get '/sign_out' =&gt; 'devise/sessions#destroy'
  end
  </code></pre>