admins can destroy users

I changed the permissions a little to be more consistent.

Now:
* admins can edit users
* users can destroy themselves.

There's no ui for either of them but theoretically they could. Not sure this is what we want though.

1 files changed, 7 insertions, 2 deletions

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 925b584..3407191 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,7 +2,7 @@ class UsersController < ApplicationController
 
   skip_before_filter :verify_authenticity_token, :only => [:create]
 
-  before_filter :fetch_user, :only => [:edit, :update]
+  before_filter :fetch_user, :only => [:edit, :update, :destroy]
   before_filter :authorize_admin, :only => [:index]
 
   respond_to :json, :html
@@ -34,10 +34,15 @@ class UsersController < ApplicationController
     respond_with @user
   end
 
+  def destroy
+    @user.destroy
+    redirect_to users_path
+  end
+
   protected
 
   def fetch_user
     @user = User.find_by_param(params[:id])
-    access_denied unless @user == current_user
+    access_denied unless admin? or (@user == current_user)
   end
 end