title: Rails + Devise: How to restrict a user from editing records that do not belong to him
body: <p>I'm using Rails, Devise and Mongoid.</p>
  
  <p>A user can only have one project (<code>has_one :profile</code>) but all users (and non authenticated users) can see a list of projects (I have this working). When a user is logged in they see "edit and delete" buttons next to the projects (via wrapping those buttons in <code>&lt;% if user_signed_in? %&gt;</code>). However, a signed in user sees these buttons next to all project and can edit or delete them all.</p>
  
  <p>How do I restrict a logged on user to only be able to edit only his project?</p>
  
  <p>As a bonus, is it possible to show specific content or html around the project that belongs to the signed in user (such as text that says "this is your project" or an additional class around the project's html)?</p>