Trying some different ways to secure a Rails application with user input

ControllerFormAttributes.rb

module ControllerFormAttributes
  def self.included(base)
    base.extend ClassMethods
  end

  module ClassMethods
    def form_params_accessors(type, attributes = [])
      @form_params_accessors ||= {}
      @form_params_accessors[type] ||= attributes
    end
  end
  
  def form_params_for(type)
    type = type.to_sym
    
    if current_user.try(:role_is?, 'admin')
      return params[type]
    else
      return params[type].slice(*form_params_accessors(type))
    end
  end
end

class ActionController::Base
  include ControllerFormAttributes
end

# class UsersController < ApplicationController
#   form_params_accessors :user, [:email, :password, :password_confirmation]
#
#   def create
#     @user = User.new(form_params_for(:user))
#     ...
#   end
# end