chapter 9
added authorisation, user patch, index and destroy actions