It looks like `can_create?` has been dropped here. Should there be something changed in the controller as well, so that if someone types the URL, they get rejected?