This works because the user should be redirected before the application ever tries to retrieve the relationship with this id.

      The controller code needed to get these tests to pass is remarkably concise: We just retrieve the user followed or to be followed, then follow or unfollow the user using the relevant utility method. The full implementation appears in Listing 11.34.

We can see from Listing 11.34 why the security issue mentioned above is minor: If an unsigned-in user were to hit either action directly (e.g., using a command-line tool), current_user would be nil, and in both cases the action’s second line would raise an exception, resulting in an error but no harm to the application or its data. It’s best not to rely on that, though, so we’ve taken the extra step and added an extra layer of security. 

         With that, the core follow/unfollow functionality is complete, and any user can follow (or unfollow) any other user, which you should verify both by clicking around in the sample application and by running the test suite: