class PasswordResetsController < ApplicationController

password_resets_controller.rb

 def edit
    @user = User.find_by_reset_pass_token(params[:id])

    if @user.nil?
      redirect_to '/login', :alert => 'Password reset does not exist.'
    elsif @user.reset_pass_expiration < 2.hours.ago
      redirect_to '/login ', :alert => "Password reset has expired."
    end
  end
    
  def update
    @user = User.find_by_reset_pass_token!(params[:id])
    if @user.update_attributes(params[:user])
      @user.reset_pass_token = nil
      @user.save!
      # if params are updated create session for user by matching token and pass
      if @user.valid?
        session[:user_id] = @user.id
        redirect_to account_url, :notice => "Your password has been reset!"
      else
        render 'update'
      end
    else
      flash.now[:error] = @user.errors.full_messages
      render :action => "edit"
    end
  end