There was a big security issue.

Any User could edit articles of other Users.

Therefore I added a method in the articles_controller which checks if the user is logged in and if it is one of the articles he created or if he is the admin.

There is a test for this in:
features/sign_up_and_login.rb

The second security Issue:

Any User could create a Article for any other User.

I removed the user_id from the form.
In the create method of the articles_controller, I check if the user is logged in and create the artice for this user_id

There is a test for this in:
requests/article_spec.rb
merged pull request #5 from isery by hand