Refactor code related to authentication:

* User model
* SessionsController

app/models/user.rb

@@ -3,31 +3,18 @@ require 'bcrypt'
 class User < ActiveRecord::Base
   include BCrypt
 
-  attr_accessor :password
+  attr_reader :password
   attr_accessible :email, :password, :password_confirmation
 
-  validates_presence_of :email
+  validates_presence_of :email, :password_hash
+  validates_confirmation_of :password
 
-  validates :password,
-    :presence     => true,
-    :confirmation => true
-
-  before_save :hash_password
-
-  def self.authenticate(email, password)
-    user = find_by_email(email)
-    return false if user.nil?
-    return user if Password.new(user.password_hash) == password
+  def password=(plain_password)
+    @password = plain_password
+    self.password_hash = Password.create(plain_password)
   end
 
-
-  private
-
-  def hash_password
-    self.password_hash = bcrypt(password)
-  end
-
-  def bcrypt(string)
-    Password.create(string)
+  def authenticate?(password)
+    Password.new(password_hash) == password
   end
 end