let users delete their posts

Maybe `current_user.owns?(@post)`?