This keeps admins out for now - but i don't think it's what we want in the long run. I think we'll probably restrict params based on wether a user is the user updated or just an admin.
If we want to keep admins out for now we should probably also authorize self on edit. No use in displaying an edit form you can't submit.
All in all i am not sure if we want to
a) Have a separate Admin::Users controller
b) restrict access based on actions (admins may not update or edit)
c) restrict access based on params