Though you're probably not showing a delete button to the current_user, it would add safety if your delete action also ensured that the current_user was the same as the user being deleted.