Solution for the CanCan issue with Rails strong parameters. This uses a method in the ApplicationController and calling it at the top of create/update action

CanCan and Strong Parameters Fix

class ApplicationController < ActionController::Base
  ...omitted code...
  
  def check_ability action, obj
    raise CanCan::AccessDenied unless can?(action, obj)
  end
end

class UsersController < ApplicationController
  load_and_authorize_resource except: [:create, :update]
  
  def create
    check_ability :create, User
    @user = User.new(user_params)
    if @user.save
      ...omitted...
    else
      ...omitted...
    end
  end
  
  def update
    @user = User.find(params[:id])
    check_ability :update, @user

    if @user.update_attributes(user_params)
      ...omitted...
    else
      ...omitted...
    end
  end
  
  private

  def user_params
    ...omitted...
  end
end