Change destroy method, only owner user can destroy collection

app/controllers/v1/collections_controller.rb

@@ -54,8 +54,12 @@ class V1::CollectionsController < ApplicationController
   # DELETE /v1/collections/1
   # DELETE /v1/collections/1.json
   def destroy
-    @collection.destroy
-    render status: :ok
+    if @collection.user_own?(current_user)
+      @collection.destroy
+      render status: :ok
+    else
+      render status: :forbidden
+    end
   end
 
   # POST /v1/collections/!/items