diff --git a/app/controllers/filesets_controller.rb b/app/controllers/filesets_controller.rb
index 08e2d7e..0533eea 100644
--- a/app/controllers/filesets_controller.rb
+++ b/app/controllers/filesets_controller.rb
@@ -1,44 +1,44 @@
 class FilesetsController < ApplicationController
   before_action :fetch_host, only: [:new, :create]
   before_action :fetch_job_id, only: [:new, :create]
 
   def new
     @fileset = @host.filesets.new
   end
 
   def show
   end
 
   def create
     @fileset = @host.filesets.new(fetch_params)
 
     if @fileset.save
       if @job_id.present?
         redirect_to edit_host_job_path(@host, @job_id, fileset_id: @fileset.id)
       else
         redirect_to new_host_job_path(@host, fileset_id: @fileset.id)
       end
     else
       @fileset.include_files = nil
       @fileset.exclude_directions = nil
       render :new
     end
   end
 
   def destroy
   end
 
   private
 
   def fetch_host
-    @host = Host.find(params[:host_id])
+    @host = current_user.hosts.find(params[:host_id])
   end
 
   def fetch_job_id
-    @job_id = JobTemplate.find(params[:job_id]).id if params[:job_id].present?
+    @job_id = @host.job_templates.find(params[:job_id]).id if params[:job_id].present?
   end
 
   def fetch_params
     params.require(:fileset).permit(:name, exclude_directions: [], include_files: [])
   end
 end
diff --git a/spec/controllers/filesets_controller_spec.rb b/spec/controllers/filesets_controller_spec.rb
index 541e0a2..61e26ba 100644
--- a/spec/controllers/filesets_controller_spec.rb
+++ b/spec/controllers/filesets_controller_spec.rb
@@ -1,85 +1,91 @@
 require 'spec_helper'
 
 describe FilesetsController do
   let(:host) { FactoryGirl.create(:host) }
+  let(:user) { FactoryGirl.create(:user) }
+
+  before do
+    host.users << user
+    controller.stub(:current_user) { user }
+  end
 
   describe 'GET #new' do
     before { get :new, host_id: host.id }
 
     it 'initializes a fileset' do
       expect(assigns(:fileset)).to be
     end
 
     it 'sets host the fileset\'s host' do
       expect(assigns(:fileset).host).to eq(host)
     end
 
     it 'renders' do
       expect(response).to render_template(:new)
     end
   end
 
   describe 'POST #create' do
     context 'with valid params' do
       let(:params) do
         {
           host_id: host.id,
           fileset: {
             name: FactoryGirl.build(:fileset).name,
             exclude_directions: ['/proc', '/tmp'],
             include_files: ['/home', '/media']
           }
         }
       end
 
       it 'creates the fileset' do
         expect { post :create, params }.
           to change { host.filesets(true).count }.by(1)
       end
 
       it 'redirects to a new job form' do
         post :create, params
         expect(response).to redirect_to(new_host_job_path(host, fileset_id: Fileset.last.id))
       end
 
       context 'and an existing job' do
         let(:job) { FactoryGirl.create(:job_template, host: host) }
 
         it 'redirects to the job\'s edit form' do
           post :create, params.merge(job_id: job.id)
           expect(response).
             to redirect_to(edit_host_job_path(host, job, fileset_id: Fileset.last.id))
         end
       end
     end
 
     context 'with invalid params' do
       let(:params) do
         {
           host_id: host.id,
           fileset: { invalid: :foo }
         }
       end
 
       it 'initializes a fileset with errors' do
         post :create, params
         expect(assigns(:fileset)).to be
       end
 
       it 'sets the host' do
         post :create, params
         expect(assigns(:fileset).host).to eq(host)
       end
 
       it 'does not create the fileset' do
         expect { post :create, params }.
           to_not change { Fileset.count }
       end
 
       it 'renders :new' do
         post :create, params
         expect(response).to render_template(:new)
       end
     end
   end
 end