Try to avoid changing the params hash. Do something like "args = params.clone" and work with the "args" hash.
It'd also be nice to not fail silently when the user_id is invalid. For example, if I'm not an admin, but have tried to change the user_id in the URL, it may be better to have a raised error rather than seeing my timesheet (replacing my user_id).