Devise Not Validating Password/Password Confirmation

I have a custom controller that handles the editing of user passwords based off of the code here.

User Model

attr_accessible :password, :password_confirmation, :username, :login
...
devise :database_authenticatable, 
       :lockable, 
       :registerable, 
       :recoverable, 
       :rememberable, 
       :trackable

PasswordsController

expose(:user) { current_user }

def update
  if user.update_with_password(params[:user])
    sign_in(user, :bypass => true)
    flash[:notice] = "success"
  else
    render :edit
  end
end

My edit password form is located here.

The problem is that no matter what I enter (or don't enter for that matter) into the edit password form, The "success" flash method is displayed.