On a side note, our update method for channel looks like:

```rails
  def update
    respond_to do |format|
      if @channel.update_attributes(params[:channel])
        format.json { render :json => @channel, :status => :ok }
      else
        format.json { render :json => @channel.errors, :status => :unprocessable_entity }
      end
    end
  end
```
Shouldn't we be scoping the channel to the User? Ie something like:

```rails
@channel = current_user.channels.find(params[:channel_id])
if @channel.update_attributes(params[:channel])
  ...etc
```
It really depends on how we want the app to work -- should anyone be able to delete or update the channel, or just the person that created it? If anyone should be allowed to delete or update it, what's the point of having a user attached to the channel in the first place besides being the person that created the channel? If only the person who created the channel should be able to update it, how do we prevent users from spam creating channels that we can't destroy unless we are admins?

In my view, I think this is where roles should come in. There should be a setting feature that basically should define what a user's default behavior is when they are created: can they create channels? Can they delete channels? Etc. 

This way, when an organization rolls out Kandan, they can basically choose what a new user can do.