I'd like to play it safe and do `user === current_user` and this can be done in the controller on a `before_filter` callback.