quick minor thought (feel free to disregard):

I think the way it's written now, this line can be misread pretty easily as `if the password was reset less than 4 hours ago`. Something like `if Time.current > @user.reset_password_sent_at + 4.hours` might be clearer