ruby form_for password field not submitted to params hash

Working through the ruby on rails tutorial from Hartl right now.

the password field is displaying weirdly, and when I submit some information I can see that my params hash doesn't display a password key (but displays everything else). What's going on?

views/users/new.html.erb:

<h1> Sign up </h1>
<div class = "row">
    <div class = "col-md-6 col-md-offset-3">
        <%= form_for(@user) do |f| %>
        <%= render 'shared/error_messages' %>

        <%= f.label :name %>
        <%= f.text_field :name, class: 'form-control'%>


        <%= f.label :email %>
        <%= f.email_field :email, class: 'form-control'%>

        <%= f.label :password %>
        <%= password_field :password, class: 'form-control'%>

        <%= f.label :password_confirmation, "Confirmation" %>
        <%= f.password_field :password_confirmation, class: 'form-control'%>

        <%= f.submit "Create my account", class: "btn btn-primary" %>
        <% end %>
    </div>
</div>

controllers/users_controller.rb

class UsersController < ApplicationController
  before_action :logged_in_user, only: [:edit, :update]
  before_action :correct_user, only: [:edit, :update]
  def new
    @user = User.new
  end

  def show
    @user = User.find(params[:id])
  end

  def create
    @user = User.new(user_params)
    if @user.save
      @user.send_activation_email
      flash[:info] = "Please check your email to activate your account."
      redirect_to root_url
    else
      render 'new'
    end
  end

def edit
@user = User.find(params[:id])
end

def update
@user = User.find(params[:id])
if @user.update_attributes(user_params)
flash[:success] = "Profile updated"
redirect_to @user
else
render 'edit'
end
end

  private
    def user_params
    params.require(:user).permit(:name, :email, :password, :password_confirmation)
    end

  def logged_in_user
unless logged_in?
store_location
flash[:danger] = "Please log in."
redirect_to login_url
end
end

def correct_user
@user = User.find(params[:id])
redirect_to(root_url) unless current_user?(@user)
end

end

models/user.rb

class User < ActiveRecord::Base
    attr_accessor :remember_token, :activation_token, :reset_token
    before_save   :downcase_email
    before_create :create_activation_digest

    validates :name, presence: true, length: { maximum: 50 }
    VALID_EMAIL_REGEX = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
    validates :email, presence: true, length: { maximum: 255 }, format: { with: VALID_EMAIL_REGEX}, 
    uniqueness: { case_sensitive: false }
    has_secure_password

    validates :password, length: { minimum: 6 }, allow_blank: true

    def User.digest(string)
cost = ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST :
BCrypt::Engine.cost
BCrypt::Password.create(string, cost: cost)
    end

def User.new_token
    SecureRandom.urlsafe_base64
end

def remember
    self.remember_token = User.new_token
    update_attribute(:remember_digest, User.digest(remember_token))
end

 def authenticated?(attribute, token)
    digest = send("#{attribute}_digest")
    return false if digest.nil?
    BCrypt::Password.new(digest).is_password?(token)
  end


def forget
    update_attribute(:remember_digest, nil)
end

 # Activates an account.
  def activate
    update_attribute(:activated,    true)
    update_attribute(:activated_at, Time.zone.now)
  end

  # Sends activation email.
  def send_activation_email
    UserMailer.account_activation(self).deliver_now
  end

  # Sets the password reset attributes.
  def create_reset_digest
    self.reset_token = User.new_token
    update_attribute(:reset_digest,  User.digest(reset_token))
    update_attribute(:reset_sent_at, Time.zone.now)
  end

  # Sends password reset email.
  def send_password_reset_email
    UserMailer.password_reset(self).deliver_now
  end

    def password_reset_expired?
    reset_sent_at < 2.hours.ago
  end

private

    def downcase_email
      self.email = email.downcase
    end

def create_activation_digest
    self.activation_token = User.new_token
    self.activation_digest = User.digest(activation_token)
end

end