prevent edit and destroy unless shortcut.user == current_user