can this just be a only: [:show, :create]?