Right now, users can edit some their attributes without having to enter their password because my validations are set up like this:
validates :password, :prese
I had the same problem, and the solutions above didn't work for me. I found the real culprit in my case: I had an encrypt_password callback in my User model, which was setting the password to blank each time.
before_save :encrypt_password
I fixed it by adding a condition at the end for this call back:
before_save :encrypt_password, :unless => Proc.new { |u| u.password.blank? }