Very good point you're making here. One corner case we might want to cover is user being nil and current_user being nil (not logged in) - I'm not sure that can happen or we have an UnauthenticatedUser then. If both were nil the access test below would still be true. I can check we use UnauthenticatedUser or we could do sth like...
```ruby

before_filter :fetch_user
before_filter :authorize

def fetch_user
  @user = User.find_by_param(params[:id])
  not_found('user') unless @user
end

def authorize
  access_denied unless admin? or (@user == current_user)
end

ApplicationController or so
def not_found(thing)
  if admin?
    redirect_to :action => :index, :alert => t(:no_such_thing, :thing => thing)
  else
    access_denied
  end
end
```
This way we could use the not_found in both controllers. Also two filters mean that if the first filter renders or redirects the second one will not run. So we do not need to use return or nested if statements.
What do you think?