might have added a subtle bug ;-)

app/models/user.rb

@@ -1,7 +1,13 @@
 class User < ActiveRecord::Base
   attr_accessible :email, :password, :user_id, :admin, :password_confirmation, :first_name, :last_name
   validates_confirmation_of :password, :password_confirmation
-  validates_presence_of :password, :on => :create
+  validates :password, :presence => true,
+                        :confirmation => true,
+                        :length => {:within => 6..40}
+                        # I think this makes sense, have both, right? If we are updating our password and creating one? 
+                        :on => :create,
+                        :on => :update
+                        # Solution? Remove both :on => statements, it will naturally take effect for any changes.
   validates_presence_of :email
   validates_uniqueness_of :email
   validates_format_of :email, :with => /.+@.+\..+/i