Are you getting any params warnings in the rails log with regard to not having a `params.require` for `destroy` and `update`?