update, create and destroy policy tests complete. Show controller still to be done

why not use user_params?
@user = User.new(user_params)