check correct permission before destroying

lib/report/controller.rb

@@ -95,7 +95,7 @@ module Report::Controller
   # RecordNotFound if the query at :id does not exist
   def destroy
     if @query
-      @query.destroy if allowed_to? :delete, @query
+      @query.destroy if allowed_to? :destroy, @query
     else
       raise ActiveRecord::RecordNotFound
     end