Index: test/functional/users_controller_test.rb
===================================================================
--- test/functional/users_controller_test.rb	(revision 2727)
    test/functional/users_controller_test.rb	(working copy)
@@ -117,7  117,33 @@
     put :update, :id => 1, :user => { }, :format => 'xml'
     assert_response :success
   end

   def test_should_update_user_without_needing_password
     login_as :sam
     put :update, :id => users(:sam).id, :user => { :email => 'sam@newemail.com'}
     assert_redirected_to edit_user_path(assigns(:user))
     assert_not_equal users(:sam).email, assigns(:user).email
   end

   def test_should_update_password_with_confirmation
     login_as :sam
     put :update, :id => users(:sam).id, :user => { :password => 'newpass', :password_confirmation => 'newpass'}
     assert_redirected_to edit_user_path(assigns(:user))
     assert flash.has_key?(:notice)
   end

   def test_should_not_update_password_with_wrong_confirmation
     login_as :sam
     put :update, :id => users(:sam).id, :user => { :password => 'newpass', :password_confirmation => 'notnewpass'}
     assert !flash.has_key?(:notice)
   end

   def test_should_not_update_password_with_blank_confirmation
     login_as :sam
     put :update, :id => users(:sam).id, :user => { :password => 'newpass', :password_confirmation => '' }
     assert !flash.has_key?(:notice)
   end

   def test_should_only_update_safe_fields
     # non-admin should not be able to change all this stuff
     login_as :sam
Index: app/models/user.rb
===================================================================
--- app/models/user.rb	(revision 2727)
    app/models/user.rb	(working copy)
@@ -13,6  13,7 @@
   validates_length_of       :login, :minimum => 2
   validates_length_of :password, :minimum => 5, :allow_nil => true
   validates_confirmation_of :password, :on => :create
   validates_confirmation_of :password, :on => :update, :allow_nil => true

   # names that start with #s really upset me for some reason
   validates_format_of       :login, :with => /^[a-z]{2}(?:\w )?$/i