Problems with validates_lenght_of

I’m building a login system, and I want users to be able to update their
password, first name and last name after signing up. So, when signing up
password can’t be nil, and it must be between 6…20 characters long.
However,
on update, the user can choose to leave the password field empty (but
fill in
other stuff, like first name) and then I want the User model to not
update
the password.

This is what I’ve tried so far (some code omitted):

class User < ActiveRecord::Base
attr_accessor :password, :password_confirmation
attr_accessible :login, :password, :password_confirmation,
:email, :first_name, :last_name
validates_confirmation_of :password
validates_presence_of :password, :password_confirmation, :login,
:email, :on =>
:create

validates_length_of :password, :within => 6…20,
:too_long => “must be shorter”,
:too_short => “must be longer”,
:on => :create

validates_length_of :password, :within => 6…20,
:too_long => “must be shorter”,
:too_short => “must be longer”,
:on => :update, :allow_nil => true

before_update :before_create
after_update :after_create

def before_create
if @password
self.hashed_password = User.hash_password(@password)
end
end

def after_create
@password = nil
end

end

The idea is, that if the password supplied by the form is nil, the model
won’t
change hashed_password. However, the view gives me an error message
about
password being too short, when I leave the password field empty! Why is
this,
and how could I implement this idea in another way?

Thanks in advance,

Malte