Q:

Rails 4 + Devise: Validate password

Something odd is happening when someone accepts an invitation to my website, they set their initial password, but then that password is not accepted as correct in the future.  For instance, I invited myself, and then accepted the invitation and set my initial password to "foobar".  
When I open the console and check the password I see:
User.find_by(email: "myemail@gmail.com").valid_password?("foobar")
=> false

Is there a way to view my unencrypted password so that I can diagnose where it might be getting set or some other way of finding out where the password is being updated?
Devise Initializer:
Devise.setup do |config|

  config.secret_key = '*****'

  config.mailer_sender = 'admin@foobar.com'

  config.mailer = 'CustomDeviseMailer'
  require 'devise/orm/active_record'

  config.case_insensitive_keys = [:email]
  config.strip_whitespace_keys = [:email]
  config.skip_session_storage = [:http_auth]
  config.stretches = Rails.env.test? ? 1 : 10
  config.reconfirmable = true
  config.expire_all_remember_me_on_sign_out = true
  config.password_length = 8..72
  config.reset_password_within = 6.hours
  config.sign_out_via = :delete
end

Devise Invitable Initializer:
Devise::InvitationsController.class_eval do
  def update_resource_params
    params.require(resource_name).permit( 
            :email,:encrypted_password,:reset_password_token,:reset_password_sent_at,:remember_created_at,:sign_in_count,:current_sign_in_at,:last_sign_in_at,:current_sign_in_ip,:last_sign_in_ip,:created_at,:updated_at,:admin,:invitation_token,:invitation_created_at,:invitation_sent_at,:invitation_accepted_at,:invitation_limit,:invited_by_id,:invitations_count,:invited_by_type,:employee,:is_client,:location_id,:user_type, :location_id
    )
  end
end

A:

Your password won't be accepted because this line on your devise initializer:
config.password_length = 8..72

"foobar" has only 6 characters long. Have you tried longer passwords? That's why valid_password returns false. If you want to accept passwords like "foobar" change the range for password validations.
UPDATE
Permit password on your strong parameters, you're no allowing password attribute on your controller. 
As a note, is very dangerous for you to add every field to your strong parameters. If you permit something like this, I could post anything to your controller easily and change sensitive data. For example, I could change the encrypted_password, reset_password_token among other fields that should never be changed. Only permit parameters that you want the user to pass, nothing else, or you can expose a huge security hole to your app. Reference.

