Authenticated administrator escalation via unfiltered role parameter

Mass assignment in Camaleon CMS before 2.9.1 allows remote authenticated users to gain administrator privileges through password changes. UsersController#updated_ajax passes the entire password parameter set through permit! to User#update, allowing an added role attribute to be written. Any limited-privilege account that can invoke the password-change endpoint can assign itself the administrator role and obtain full CMS control.