I have currently set my app so that on successful sign in the app redirects the user to their profile at `localhost:3000/users/id` however if I am the first user `id => 1` and type `users/2` I have full access to this profile. I have been trying to find how to stop this using devise. I'm pretty new to rails so I'm sure I'm missing something simple, I have used the `before_filter :authenticate_user!` but this is obviously just checking if a user is signed in, but doesn't limit access to other users' profiles. I have read a bit on CanCan but this seems a bit overkill for what I am trying to achieve. Any pointers much appreciated. 

users\_controller.rb

```
class UsersController < ApplicationController
  before_filter :authenticate_user!
  before_filter :user_authorization

  def index
    @users = User.all
  end

  def show

    @user = User.find(current_user[:id])

  end

  private

     def user_authorization
        redirect_to(root_url) unless current_user.id == params[:id]
     end
end 

```

This is being reported from the server:

```
Started GET "/users/2" for 127.0.0.1 at 2012-06-24 13:00:38 +0200
Processing by UsersController#show as HTML
  Parameters: {"id"=>"2"}
  User Load (0.1ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 2 LIMIT 1
  User Load (0.2ms)  SELECT "users".* FROM "users" WHERE "users"."id" = ? LIMIT 1  [["id", 2]]
Redirected to http://localhost:3000/
Filter chain halted as :user_authorization rendered or redirected
Completed 302 Found in 20ms (ActiveRecord: 0.8ms)

```