def change_password

@user = User.find(params[:id])

if request.post?
if User.authenticate(@user.username,
params[:password][:old_password]) == @user
@user.password = params[:password][:new_password]
@user.password_confirmation =
params[:password][:new_password_confirmation]
if @user.save
flash[:notice] = 'Your password has been changed'
redirect_to :action => 'edit_my_information'
else
flash[:error] = 'Unable to change your password'
end
else
flash[:error] = 'Invalid password'
end
end
end