Listing 11.32 tests the following buttons by clicking on them and specifying the proper behavior. Writing the implementation involves digging a little deeper: Following and unfollowing involve creating and destroying relationships, which means defining create and destroy actions in a Relationships controller (which we must create). Although the following buttons only appear for signed-in users, giving us a superficial layer of security, the tests in Listing 11.32 miss a lower-level issue, namely, the create and destroy actions themselves should only be accessible to signed-in users. (This is the security hole alluded to above.) Listing 11.33 expresses this requirement using the post and delete methods to hit those actions directly.