def change
    # POST /lost_password/:token
    reset_token = UserPasswordResetToken.find_by_token( params[:token] )

    # Check for mismatched passwords
    if params[:password] != params[:password_confirmation]
      flash[:error] = 'The new passwords did not match.'
      render :action => :new and return
    end

    if reset_token.respond_to?( :expires ) && reset_token.expires >= Time.now.utc
      user = reset_token.user

      if user.nil?
        # User associated with this reset_token doesn't exist
        render :action => :new and return
      end

      user.password = params[:password]
      user.password_confirmation = params[:password_confirmation]

      if user.save
        # puts "Changed the password to #{user.password}"
        # Redirect to homepage or destination url
        flash[:notice] = 'Your password has successfully been changed.'
        redirect_to reset_token.destination_url.to_s.empty? ? '/' : reset_token.destination_url.to_s
      else
        # Couldn't save new password
        flash[:error] = "Could not change the new password: #{user.errors.full_messages.join(", ")}"
        render :action => :new and return
      end
    end