When you save the password fields, it's been hashed every time. You have to put it in your User model. Thanks to Karl Merkli to add needsRehash