refactor.rb

class UsersController < ApplicationController

  before_filter :authorize!

  def edit
    @user = User.find(params[:id])
  end

  def update
    @user = User.find(params[:id])
    if @user.update_attributes(user_params)
      redirect_to :root, notice: "Profile successfully updated."
    else
      render :action => "edit"
    end
  end
  
  def authorize!
    case action
    when :edit, :update
      raise AccessDenied unless @current_user.id.eql?(params[:id])
    else
      raise AccessDenied unless @current_user.is_admin? 
    end
  end

end

class ApplicationController < ActionController::Base
  
  rescue_from AccessDenied, with: unauthorized_access_attempt
  
  def current_user
    @current_user ||= User.find(session[:user_id]) if session[:user_id]
  end

  def user_signed_in?
    current_user.present?
  end

  def unauthorized_access_attempt
    redirect_to :root, alert: "You don't have permission to do that!"
  end
  
end