title: Security - Checking if current user exists before executing code
body: <p>In one of my controllers I have this method:</p>
  
  <pre><code>  def method_name
      if current_user
        @model = Model.find(params[:id])
        if @model.destroy
          flash.alert = 'Model deleted successfully'
          redirect_to models_path
        end
      end
    end
  </code></pre>
  
  <p>I check if there is a current_user assigned by devise before giving the ability for the @model to be deleted. Is this safe and sufficient in terms of security?</p>
  
  <p>What I really do is just checking if current_user exists. So is there a way that somebody can "trick" the system that current_user does exist and as a result be able to trigger the commands included in the method?</p>