Mass assignment and roles in Rails
===

I have `Users, Roles, and Network` models in Rails 3. `Users` and `Networks` have a HMT relationship through `Roles`. If a `User` has an `Role` type of 'admin' with a specific `Network`, he/she can change the `Role` of other `Users`.

It seems like the `Role` type should not be available via mass-assignment. So how does a `Network` admin change the position type of other `Users`? I actually think this is a really basic question, but I just can't find the answer.

I am using CanCan and have a current_user method. Does that simply mean the controller would have a simple if/then check to see if the user has the appropriate role in a network?

Does mass assignment only apply to pages that have no authentication?