> I don't think I've encountered a site that had accounts edited this way before. Any site that employs the pattern of specifying user account routes using the

> I don't think I've encountered a site that had accounts edited this way before. Any site that employs the pattern of specifying user account routes using the user's primary key in the URL needs to implement authorization. This site clearly skipped that step. To me, this looks like the stereotypical bare-bones rails deployment by a newbie.