Are we sure we want everybody to access everybody else manifests? I suggest to go through `current_user` here.