Remember that this is an error message, so it needs to be clear what's going on to the user. What about something like "Expected model to declare has_secure_password, but it did not"? Similar for the negative message.

Additionally, instead of using #failure_message and #negative_failure_message, can you use #failure_message_for_should and #failure_message_for_should_not instead?