id is in the url, so params, duh!
properly returning unauthorized error, rather than raising and then returning internal error
associating user on School.create and deleting associated reviews on School.remove