Might want to add a test to assert that `current_user` is `nil`