We probably don't want to show the edit form unless a user has access to edit the list. We could have a redirect here:

    def edit
      @list = List.find(params[:list_id])
      unless @list.user == current_user
        redirect_to user_lists_path(current_user), notice: 'That is not your list.'
      end

      @item = ListItem.find(params[:id])
    end