OO nit:

Does a user know that it has a password?  No, it has things like a name and a gender, an address, etc.

BUT  there is an OO model lurking here that you are :+1:  for seeing needs to exist.  How about a `PasswordValidator` class.  Try `PasswordValidator.new(@user, params[:password]).valid?`  The `PasswordValidator` can implement the interfacing of the `BCrypt` hash interface being `==` to the `params[:password]`.