## RESET PASSWORD
  def reset_password
    # get user
    @user = User.find_by_login params[:id]

    if @user
      if @user.reset_password_code == params[:code]
        if Time.now < @user.reset_password_code_until
          begin
            # reset password
            @user.password = params[:password]
            @user.password_confirmation = params[:confirm]
            @user.reset_password_code = nil
            @user.reset_password_code_until = nil
            @user.save!

            # redirect to confirmation page
            redirect_to :action => 'password_confirmation'
          rescue Exception
            # render password reset page with validation errors
            render :action => 'password'
          end
        else
          # reset password code expired
          @user.errors.add 'reset_password_code', 'has expired.'
          render :action => 'password'
        end
      else
        # invalid reset code
        @user.errors.add 'reset_password_code', 'is not valid'
        render :action => 'password'
      end
    else
      # user not found
      redirect_to '/'
    end
  end