- Previously, we were pulling `params[:user][:password] as the default
  value for the password field. This is incorrect; we should be pulling
  it from `@user.password` or the like.