Password confirmation

Also, you don't need to nest it under user - it can just be `token: @token` and in the controller you can do `params[:token]`