Something

  def update
    if @session['user'].can_administrate_users
      @user = User.find(params[:id])
      if @user.update_attributes(params[:user])
        flash[:notice] = 'User was successfully updated.'
      else
        flash[:notice] = 'User failed to be updated.'
      end
      redirect_to :action => "permissions"
    else
      redirect_to :action => "login"
    end
  end