had to move 'require_same_user' method to application_controller.rb