Mod4a

Per your comment on the forum, this is very close to how I would handle this. The only difference is that I would set the token to nil if the user is saved with the new password. You are currently leaving a token in the db, which is the security issue Kevin was talking about. I think Matthew was mistaken and thought this was `UsersController`.