ruby on rails 3 - Devise: Change any users password as admin -

so seems simple enough, have controller action looks this:

class admin::userscontroller < admin::basecontroller ... def update_password   @user = user.find(params[:user][:id])   @user.password = params[:user][:password]   if @user.save!     notifier.admin_password_change(@user).deliver     flash[:success] = "password changed!"     redirect_to edit_admin_user_path(@user)   else     render "edit"   end end end 

and never seems work. need more advanced here? here's see in rails console:

started put "/admin/users/update_password" 127.0.0.1 @ 2013-07-15 10:01:50 -0600 processing admin::userscontroller#update_password html   parameters: {"utf8"=>"✓", "authenticity_token"=>"ipedx2mjdztqct6i4fuobrzdpmnl3pqwnvr9ez7bdvc=", "user"=>{"id"=>"226", "password"=>"[filtered]", "password_confirmation"=>"[filtered]"}, "commit"=>"change password"}   (6.8ms)  alter session set edition = epact_redesign   user load (8.4ms)  select "cred_app_users".* "cred_app_users" "cred_app_users"."id_number" = 10040 , rownum <= 1   codemodel load (9.1ms)  select "cred_codes".* "cred_codes" (table_name = 'cred_vehicles' or table_name = 'cred_fleet')   user load (3.6ms)  select "cred_app_users".* "cred_app_users" "cred_app_users"."id_number" = :a1 , rownum <= 1  [["id_number", "226"]]   (3.3ms)  update "cred_app_users" set "encrypted_password" = 'encrypted password string', "modify_dt" = to_date('2013-07-15 16:01:50','yyyy-mm-dd hh24:mi:ss') "cred_app_users"."id_number" = 226  rendered notifier/admin_password_change.erb (0.1ms)  sent mail random@person.com (22ms) ... 

what doing wrong here? email prints out in console, , :success flash appears @ top of screen, password hasn't changed.

can't understand why, needed set password_reset_token, , worked. here's method looks now:

def update_password   @user = user.find(params[:user][:id])   @user.reset_password_token = 'temp'   @user.save!   if @user.reset_password!(params[:user][:password], params[:user][:password_confirmation])     notifier.admin_password_change(@user).deliver     flash[:success] = "password changed!"     redirect_to edit_admin_user_path(@user)   else     render "edit"   end end 

the token get's blown away when reset_password! method runs. couldn't find in docs alluded needing reset_password_token, seems required. wouldn't code pretty, solution works. if else comes better, i'll change answer.