Mod4a

My issue with this is mainly that it is asserted the save is done successfully even though it may not have been and it will tell the user `Your password has been changed. Please sign in.` even though a validation might have failed and the password may not have been updated. 

I would write it like this:

```ruby
  def create
    user = User.find_by(token: params[:token])
    user.password = params[:password]
    user.generate_token
    if user.save
      flash[:success] = "Your password has been changed. Please sign in."
      redirect_to login_path
    else
      flash[:error]   = "Your password was unable to be updated" 
      redirect_to expired_token_path
    end
  end
```