Add test for forbidden attribute request for admin permission, and change the code to fail it temporary (exercise 9.6.1).
...and fix it to pass the test!
Change the gravatar setting link for opening in browser's another tab (exercise 9.6.2).
Add tests for checking links for signed-in user when you are not signing in (exercise 9.6.3).
Use utility 'sign_in' in many place now (exercise 9.6.4).
Replace fields for User by partial. (exercise 9.6.5).
Add redirecting when you access to the signup page as a signed-in user, and test also. but the test is not work well now. I gonna skip this probem for testing because it's in the out of reach of this exercise. (exercise 9.6.6)
add the code of request.xxx method for checking. (exercise 9.6.7)
Now the system will avoid deleteing admin itself with sending delete action. (exercise 9.6.9)