What if you did `user.valid_password?(params[:password])`? this would:

1. be easy to test, as you wouldn't have to simulate a params hash when testing the function
2. Keep the logic for validating passwords close to the user model.