Requires current_user == user for update and destroy action