Something

  def update
    if @session['user'].can_administrate_users
      @user = User.find(params[:id])
      if @user.update_attributes(params[:user])
        flash[:notice] = 'User was successfully updated.'
      else
        flash[:notice] = 'User failed to be updated.'
      end
      redirect_to :action => "permissions"
    else
      redirect_to :action => "login"
    end
  end


******

<%= flash[:notice] %>
<table>
  <% for user in @users %>
    <%= start_form_tag :action => 'update', :id => user %>
      <tr>
        <td>
          <b><%=user.last_name%>, <%=user.first_name%></b> (<%= user.login %>)
        </td>
      </tr>
      <tr>
        <td>
          Can Delete <%= check_box :user, :can_delete %>
        </td>
        <td>
          <%= submit_tag 'Update'%>
        </td>
      </tr>
    <%= end_form_tag %>
  <% end %>
</table>