using @warden.user instead of "current_#{scope}"

`current_user` might not be defined in `ApplicationController` (e.g. admin section is protected with devise, rest of website is public)