rename #lock_user! to #remember_current_user
don't clear the remembered user on logout, we need a different mechanism for this
send the original_user in to the guard for evaluation