don't access current_user for visitor show itinerary