If I have a controller like the one below, what's the best way to protect my show action? 
The way it currently is setup any user can view the Note of another user with just the id.

```
class NotesController < ApplicationController
    before_action :authenticate_user!

    def index
        @notes = Note.where(user_id: current_user)
    end

    def show
        @note = Note.find(params[:id])
    end

    def new
        @note = current_user.notes.build
    end

end

```