Allow writes in controller::render(), refactored current_user passing