Note here the hidden input field 

Since web browsers can’t natively send PUT requests (as required by the REST conventions from Table 7.1), Rails fakes it with a POST request and a hidden input field.3 There’s anothersubtlety to address here: The code form_for(@user) in Listing 9.3 is exactly the same as the code in Listing 7.17—so how does Rails know to use a POST request for new users and a PUT for editing users? The answer is that it is possible to tell whether a user is new or already exists in the database via Active Record’s new_record? boolean method:

When constructing a form using form_for(@user), Rails uses POST if @user.new_ record? is true and PUT if it is false.As a final touch, we’ll add a URI to the user settings link to the site navigation. Since it depends on the signin status of the user, the test for the ‘‘Settings’’ link belongs with the other authentication tests, as shown in Listing 9.5. (It would be nice to have additional tests verifying that such links don’t appear for users who aren’t signed in;
writing these tests is left as an exercise (Section 9.6).)