change @user to @current_user and verify change in app.