finished write-up for broken auth

app/controllers/users_controller.rb

@@ -16,7 +16,7 @@ class UsersController < ApplicationController
     else
       @user = user
       flash[:error] = user.errors.full_messages.to_sentence
-      redirect_to :sign_up
+      redirect_to :signup
     end
   end
 

app/models/user.rb

@@ -5,7 +5,13 @@ class User < ActiveRecord::Base
                        :length => {:within => 6..40},
                        :on => :create,
                        :if => :password#,
-                       #:format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+=begin                       :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+  validates :password, :presence => true,
+                        :confirmation => true,
+                        :on => :update,
+                        :if => :password,
+                        :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+=end  
   validates_presence_of :email
   validates_uniqueness_of :email
   validates_format_of :email, :with => /.+@.+\..+/i

app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb

@@ -70,11 +70,19 @@
 				<li>1 special character</li>
 			  </p>	
 			  <pre class="ruby">
-				  validates :password, :presence => true,
+			  # VALIDATE PASSWORD BOTH AT CREATION AND WHEN UPDATING	 
-				                       :confirmation => true,
+			  validates :password, :presence => true,
-				                       :length => {:within => 6..40},
+			                        :confirmation => true,
-				                       :on => :create,
+			                        :length => {:within => 6..40},
-				                       <span style="background-color: yellow">:format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}</span>
+			                        :on => :create,
+			                        :if => :password,
+			                        :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+			  validates :password, :presence => true,
+			                         :confirmation => true,
+			                         :on => :update,
+			                         :if => :password,
+			                         :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+										
 			  </pre>	
             </div>
           </div>