Remove attr_accessor from user model, so has_secure_password works