audit the rails controller action of a logged in user keeping privacy issue in