whitelisting controller actions - so that users cannot destroy another user's listing
merged with master