Agreed.

On a related note, I'd like to know why useful business logic keeps getting stuck in controllers.  (A lot of this `update` action seems like it really needs to be pushed to the model layer.)  I thought it was clear that such code can no longer be confined to a single request.