or security sake, password should be protected from mass assigns IMO. For instance on my site we have a change password
link and an update user info link. The password link has the standard : old password, new password, confirm password
format. The update user info form doesnt have the option to update the password, just the email and other fields added.
If this were not protected, they would be able to change the password without confirming the old password.

In registration_controller.rb Get rid of ~22:

      params[:user][:password] = params[:password]
      params[:user][:password_confirmation] = params[:password_confirmation]

and add this below ~33

      @user = User.new(params[:user])

# these must be directly assigned now for security
@user.password = params[:password]
@user.password_confirmation = params[:password_confirmation]