In UserMixin?.rb:

~125:
# After validation, the password should be encrypted  
after_validation :encrypt_password

should be changed to 
# before save, the password should be encrypted  
before_save :encrypt_password

Otherwise, calling user.valid? will cause the password to be encrypted, and will cause a subsequent user.save to fail
because of the

~403:   if @new_hash_type and not (@new_password or password.nil?)

since encrypt_password resets @new_password.