I think this method might be better placed inside the `ShortUrl` mode rather than the controller, so you'd end up with something like `@short_url.is_owned_by(current_user)` (will need a test case, also)