I think there was a subtle bug in the intentional security bypass within the admin controller
Merge branch 'master' of github.com:OWASP/railsgoat