title: Making a user an admin user through a button without having the attribute accessible in Rails
body: <p>From what I understand it would create a security flaw if I were to let my admin boolean in my users model be listed in attr_accessible. However I want a link on my show page that lets existing admin users grant admin privileges to other users. I was wondering how to go about doing this? My code in my show view for a user at the moment includes:</p>
  
  <pre><code>  &lt;% if current_user.admin? &amp;&amp; @user.admin == false %&gt;
      &lt;%= link_to "Make Administrator", '#', 
      data: { confirm: "Make this user an admin?" }, class: "btn btn-large btn-primary" %&gt;
    &lt;% elsif current_user.admin? &amp;&amp; @user.admin%&gt;
      &lt;%= link_to "Remove Administrator", '#', class: "btn btn-large btn-danger" %&gt;
    &lt;% end %&gt;
  </code></pre>
  
  <p>I'm not entirely sure what to put instead of the '#'? @user.toggle!(:admin) doesn't seem to work so any pointers would be appreciated. Thank you in advance!</p>