Users can only edit, update, and delete books which belong to them.

Here's the additions.  Some things I didn't do are: put null => false on the user_id column, validate the presence of a user_id in book.