target_id in ControllerExtensions

In ControllerExtensions, the target_id will be assigned params[:id] first, and will be assigned target_object's id if params[:id] is illegal. But I think target_id should be target_object's id first, because params[:id] is depend on external environment, anybody can pass a param to make the app wrong. 

https://github.com/tute/merit/blob/master/lib/merit/controller_extensions.rb#L46