user_controller

   def reset_password
      @user = User.find_by_password_salt(params[:temppass])
      if @user.blank?
         flash[:notice] = "Temporary password incorrect. Please try again."
         redirect_to :action => "recover_password", :layout =>"schools"
      else
         @user.password = params[:password]
         flash[:notice] = "Hashed: #{@user.password_hash}, Salt: #{@user.password_salt}"
         if @user.save
            flash[:notice] = "Your new password has been registered."
            redirect_to :controller => session[:intended_controller], :action => session[:intended_action]
         else
            flash[:notice] = "For some reason, your new password didn't get saved."
            redirect_to :action => "recover_password", :layout => "schools"
         end
      end
   end


user.rb

require 'digest/sha2'

class User < ActiveRecord::Base
	validates_uniqueness_of :email
	validates_length_of :password, :within => 6..20
	validates_presence_of :email, :password, :name_given_en, :name_family_en
	validates_format_of :email, :with => /^([^@\s] )@((?:[-a-z0-9] \.) [a-z]{2,})$/i,
            :message => "Invalid email"

	def password=(pass)
		salt = [Array.new(6){rand(256).chr}.join].pack("m").chomp
		self.password_salt, self.password_hash = salt, Digest::SHA256.hexdigest(pass   salt)
	end

end

error message: undefined method `password' for #<User:0x337c540>

BUT:  session dump shows:

---
flash: !map:ActionController::Flash::FlashHash
  :notice: "Hashed: 98dfa4512cc1746d2dccf3e2aa69cd6be3778c89c5b2e4364dc65a8fd46a9ed7, Salt: dgIi736z"