use spree_current_user to prevent password fields turning up