I'm not sure this would actually affect my rails app, because we have a seperate and distinct authentication process on accounts (which helps!). Users register

I'm not sure this would actually affect my rails app, because we have a seperate and distinct authentication process on accounts (which helps!). Users register and the information is written into a temporary table. Then user data is copied from that table (and the temporary table doesn't store anything like 'is_admin') into the active user table upon authentication. Users are automatically not administrators of course, and the setting of an admin flag must be done manually. Works well for us :)