in app/controllers/password_resets_controller.rb [51:57]
def valid_user unless (@user && @user.activated? && @user.authenticated?(:reset, params[:id])) redirect_to root_url end end