@randx The problem is that now you don't need to be the admin anymore to POST the destroy URL and remove users: you can remove yourself at that URL, even if you are not the admin.
If we keep the before filter, it will never enter destroy action, and you can't destroy yourself.