I think it would be nicer to use the "update_permitted" and "destroy_permitted" methods in the model, what do you think?