title: Rails 4 - Users are able to book spaces even if they back out of PayPal payment
body: <p>So I have an e commerce type rails app where users are able to list spaces to be booked, and other users are able to book these spaces for a specified amount of time. </p>
  
  <p>I used this tutorial, <a href="http://www.gotealeaf.com/blog/basic-paypal-checkout-processing-in-rails" rel="nofollow">http://www.gotealeaf.com/blog/basic-paypal-checkout-processing-in-rails</a>, to set up my system.</p>
  
  <p>Once a user submits a form to create a new booking, they are redirected to the PayPal website where they log in to paypal, confirm they are paying, and once they have paid they have an option to return to my website and see their booking invoice. </p>
  
  <p>My issue is that when a user clicks submit on their new booking form and they are taken to the paypal website, they may press back on their browser, taking them back to my website, but their booking is now recorded.</p>
  
  <p>How do I stop a booking from being recorded unless it has been paid for through paypal?</p>
  
  <p>Here is my create action from my bookings controller:</p>
  
  <pre><code>def create
      @booking =  Booking.new(params[:booking].permit(booking_params)
      @booking.space = @space
      Space.find(@space.id).update_attributes( :balance =&gt; @space.balance + (@booking.length * @space.hourly_rate))
      if @booking.save
        redirect_to @booking.paypal_url(space_booking_path(@space, @booking))
      else
        render 'new'
      end
  end     
  </code></pre>
  
  <p>Also my app/models/booking.rb:</p>
  
  <pre><code>class Booking &lt; ActiveRecord::Base
  include Bookable
  
    def paypal_url(return_path)
    values = {
      business: "nikia.i-facilitator@peerparking.ca",
      cmd: "_xclick",
      upload: 1,
      return: "#{Rails.application.secrets.app_host}#{return_path}",
      invoice: id * rand(19284),
      amount: space.hourly_rate * length,
      item_name: space.address,
      item_number: space.id,
      quantity: '1',
      notify_url: "#{Rails.application.secrets.app_host}/hook"
    }
    "#{Rails.application.secrets.paypal_host}/cgi-bin/webscr?" + values.to_query
    end
  
  end
  </code></pre>
  
  <p>And the relevant route in my routes.rb</p>
  
  <pre><code>post "spaces/:space_id/bookings/:id" =&gt; "bookings#show"
  </code></pre>