Account

I bet no admin can be allowed to set account_id to something else than his parent account. Please remove account_id from user_params, that should be ok, as you already set this by doing current_account.users.
This is a serious security issue.