The fact that user credentials (or any sensitive data) is directly modifiable through a web interface is concerning to me. Shouldn't this logic be protected in the controller layer?
Basic Rails code to update your own details on the 'view my details' screen is something like
def update_details
@logged_in_user = User.find_by_id(session[:userid])
@logged_in_user.update_attrs(params[:user])
@logged_in_user.save
end
Sticking in attr_protected :is_admin in your model means that ActiveRecord will just ignore that attribute if it is bulk assigned securing it with a single line of code.
Attr_accessible was new in Rails 2 (I think) - its says deny all BUT the ones listed - best way by far.