whitelisting controller actions

so that users cannot destroy another user's listing