Be very careful with `attr_accessible`. We may not have routes that can edit the user in transition now (and we may never, so this may never be a problem), but anything in `attr_accessible` is fair game for a client to submit malicious POST requests with. If we ever got a `User#update` route this would be a security hole. A good rule of thumb is: don't put anything in `attr_accessible` that you wouldn't want a user to change him or herself. I'd let a user change her own email address, but not her `:permissions`.

Like I say, this may never be an issue in this app as we may never change a user. I think just seeing `attr_accessible` on the same line as `:permissions` fires up some neural pathway for me that puts me in nagging grandpa mode, though.