```ruby
class UsersController < ApplicationController
  before_filter :authenticate_user!, except: :index

  def index
    @users = User.top_rated.paginate(page: params[:page], per_page: 10)
    authorize @users
  end

  def show
    @user = User.find(params[:id])
    authorize @user
    @posts = @user.posts.visible_to(current_user)
  end

  def update
    if current_user.update_without_password(user_params)
      flash[:notice] = "User information updated"
      redirect_to edit_user_registration_path(current_user)
    else
      render "devise/registrations/edit"
    end
  end

  private

  def user_params
    params.require(:user).permit(:name, :avatar, :email_favorites)
  end
end
```

Use update_attributes instead of update_without_password because strong parameters already filter out any possible password params.
user
```ruby
class UsersController < ApplicationController
  before_filter :authenticate_user!, except: :index

  def index
    @users = User.top_rated.paginate(page: params[:page], per_page: 10)
    authorize @users
  end

  def show
    @user = User.find(params[:id])
    authorize @user
    @posts = @user.posts.visible_to(current_user)
  end

  def update
    if current_user.update_attributes(user_params)
      flash[:notice] = "User information updated"
      redirect_to edit_user_registration_path(current_user)
    else
      render "devise/registrations/edit"
    end
  end

  private

  def user_params
    params.require(:user).permit(:name, :avatar, :email_favorites)
  end
end
```
assistant