only user that created rating can delete it

app/controllers/ratings_controller.rb

@@ -22,7 +22,7 @@ class RatingsController < ApplicationController
 
   def destroy
     rating = Rating.find params[:id]
-    rating.delete
-    redirect_to ratings_path
+    rating.delete if current_user == rating.user
+    redirect_to user_path current_user
   end
 end