USER MODEL :::

require 'digest/md5'
class User < ActiveRecord::Base

  attr_accessor :password_confirmation

  validates_presence_of :username, :password, :email, :zipcode, :firstname, :lastname

  validates_uniqueness_of :username, :email

  validates_length_of :username, :within => 3..20
  validates_length_of :password, :within => 4..20
  validates_length_of :firstname, :within => 4..20
  validates_length_of :lastname, :within => 4..20
  validates_length_of :zipcode, :maximum => 5
  validates_length_of :email, :maximum => 40

  validates_format_of :username, :with => /^[A-Z0-9_]*$/i, :message => "Username can only contain numbers, letters and underscore"
  validates_format_of :email, :with => /^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i , :message => "Email address was not properly formated"
  validates_confirmation_of :password

  def self.authenticate(login,pass)
    self.find_by_username_and_password(login, md5(pass))
  end

  protected

  def password=(val)
    self[:password] = self.class.md5(val) unless val.blank?
  end

  def self.md5(pass)
    Digest::MD5.hexdigest("--golf-time--#{pass}---")
  end


end

USER CONTROLLER ::::
class UserController < ApplicationController

  def register
    @user = User.new(params[:user])
    if request.post? and @user.save
        flash[:notice] = "User has been added"
        redirect_to :action => 'login'
    end
  end #register

  def login
    @user = User.new(params[:user])
    if request.post? and params[:user]
      user = User.authenticate(@user.username, @user.password)
      if user
        session[:userid] = user.id
        flash[:notice] = "you have been logged in"
        redirect_to :action => 'edit'
      else
        @user.password = nil
        flash[:notice] = "invalid username and/or password"
      end

    end
  end #login

  def edit
    @user = User.find(session[:userid])

    if request.post? and params[:user]
      @user.update_attributes(params[:user]);
      flash[:notice] = 'user info has been updated'
    end

  end
end


FORM ERRORS :::

2 errors prohibited this user from being saved

There were problems with the following fields:

    * Password doesn't match confirmation
    * Password is too long (maximum is 20 characters)