<code>self.password.nil?</code> is confusing (to me).  I know its not you "fault", but a comment explaining, why we can have nil passwords would help here. (it is nil, if the password wasn't set since the last save)