Fixed bug introduced in users_controller.rb by last commit: In testing access_levels, we have to scope the params hash to the user subhash.