We do have a route for updating the user: when the user is changed in Signon a push message is sent to each app. From ``rake routes``: 
```ruby
PUT  /auth/gds/api/users/:uid(.:format)                      api/user#update
```

I completely agree that attr_accessible must be used carefully; that's why there is ``as: :oauth`` on the end of the statement to restrict it to the OAuth exchange and Signon push messages.