category.can_delete? 改為非 private method、加上必填欄位驗證