add "wrong user" tests
add correct_user private method
add current_user? helper
remove setting user from edit and update methods, as correct_user now gets it
friendly forwarding