Mod 3 week 4 mailer and deployment

1) Starting at the 39th minute of the solution video to assignment 18, Kevin uses a lot of, alice,update_column('12345') -- I do not understand why he needs to do this if you have call backs in the user model that provide a token for every user. Moreover don't you update the token in the create controller action of password resets?

2) I saw that we used, @user = User.where(token: params[:id]).first, to find the user in the params hash, which was sent to us by the named route's, reset_password_url, parameter, (@a_user.token). This is the route: reset_password GET    /reset_passwords/:id(.:format)      reset_passwords#show -- was there a more efficient or straight forward way of going about this? I must admit that without the solutions I would have been a goner. It was very hard for me to understand that, :id, could contain anything else other than the primary key of the object, which is what rake routes suggests. 

3) How does this code in ResetPassword#create, @user.password = password_reset_params[:password] -- change the user's password. The attribute, .password, is not even a column on the user's table. Moreover, does rails not have security procedures set up in place that can prevent this? Are we hacking rails a bit to allow for this business logic to flow through?

4) If we are updating a password then why is the HTTP verb, post? Shouldn't it be patch, and shouldn't we be using the update action for user? It appears that we are using a virtual resource, ResetPasswords, to update a model backed object, User. Are we going around conventions here?

5) I also implemented the migration, AddTokenToEachUser, a little differently than Kevin. Was it necessary to do this migration? Couldn't you just in rails console assign a token to every user?