@henriquelampert I still think the verification can be better. See my suggestion below for the user_params method:

```ruby
def user_params
  user_attributes = [:name, :email, :password, :password_confirmation]
  user_attributes.push(:is_admin) if current_user.is_admin
  params.require(:user).permit(*user_attributes)
end