Added test for forbidding to issue PATCH req directly to update method.
$ be rspec spec/                                                                                                              (master[-] @0) [~/program/rails_tutorial/sample_app]
.......................................................................................

Finished in 5.12 seconds
87 examples, 0 failures

Randomized with seed 65159
Failure test: add "admin" to permitted user_params
$ be rspec spec/requests/user_pages_spec.rb                                                                           (exercise_9_6_1[-] @0) [~/program/rails_tutorial/sample_app]
...................F.........

Failures:

  1) User pages edit forbidden attributes
     Failure/Error: specify { expect(user.reload).not_to be_admin }
       expected admin? to return false, got true
     # ./spec/requests/user_pages_spec.rb:151:in `block (4 levels) in <top (required)>'

Finished in 3.4 seconds
29 examples, 1 failure

Failed examples:

rspec ./spec/requests/user_pages_spec.rb:151 # User pages edit forbidden attributes

Randomized with seed 50501
Successful test.
$ be rspec spec/requests/user_pages_spec.rb                                                                           (exercise_9_6_1[-] @0) [~/program/rails_tutorial/sample_app]
.............................

Finished in 3.51 seconds
29 examples, 0 failures

Randomized with seed 48108
Merge pull request #14 from Tacahilo/exercise_9_6_1

Rails Tutorial Exercise 9.6.1のレビューのお願い