Should this be :validate => :password if it's a secret? And if so, shouldn't passwword fields be required?