I think this should be `@user.salaries.find(params[:id])` to prevent anyone from editing/updating/destroying someone else's salary.

Or am I missing something?