How to update an user without changing his credentials
class User < ActiveRecord::Base
  authenticates_with_sorcery!

  attr_accessible :username, :email, :password, :password_confirmation

  has_many :clients
  has_many :orders

  validates_presence_of :email, :username, :on => :create
  validates_presence_of :password, :on => :create
  validates_uniqueness_of :email
  validates_confirmation_of :password, :message => "confirmation doesn't match password "
  validates_length_of :password, :minimum => 6
end

class UsersController < ApplicationController
    before_filter :require_login, :except => [:not_authenticated, :new, :create]
    skip_authorize_resource :only => [:new, :create]

    layout "users"

  def new
      @user = User.new
    end

    def create
      @user = User.new(params[:user])
      if @user.save
        redirect_to clients_url, :notice => "Bienvenu dans la communauté Bakden!!!"
      else
        render :new
      end
    end


 #show user profile
  def show
        @user = User.find(session[:user_id])

            respond_to do |format|
          format.html # show.html.erb
          format.json { render json: @user }
        end
      end

# edit user profile
  def edit
    @user = User.find(session[:user_id])
  end

# update user profile

  def update
    @user = User.find(session[:user_id])

    respond_to do |format|
      if @user.update_attributes(params[:user])
        format.html { redirect_to(@user, :notice => 'User was successfully updated.') }
        format.json  { head :ok }
      else
        format.html { render :action => "edit" }
        format.json { render json: @user.errors, :status => :unprocessable_entity }
      end
    end
  end

<%= simple_form_for (@user),:html => {:multipart => true} do |f| %>

  <div class="inputs">
    <%= f.input :adress %>
    <%= f.input :city %>
    <%= f.input :country ,:as => :country %>
    <%= f.input :telephone, :as => :string %>
    <%= f.file_field :picture %>

  <div class="actions">
    <%= f.button :submit %> | <%= link_to "cancel", profile_path%>
  </div>
<% end %>

# Update record attributes when :current_password matches, otherwise returns
  # error on :current_password. It also automatically rejects :password and
  # :password_confirmation if they are blank.
  def update_with_password(params, *options)
    current_password = params.delete(:current_password)

    if params[:password].blank?
      params.delete(:password)
      params.delete(:password_confirmation) if params[:password_confirmation].blank?
    end

    result = if valid_password?(current_password)
      update_attributes(params, *options)
    else
      self.attributes = params
      self.valid?
      self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
      false
    end

    clean_up_passwords
    result
  end

  # Set password and password confirmation to nil
  def clean_up_passwords
    self.password = self.password_confirmation = nil
  end