bugfix: current_user may be nil