this whole block seems completely redundant. In addition the functionality shouldn't be part of the superclass of ALL controllers but instead of the user model. Please also see the already existing update_role-method and its usage in the user model.