Can `current_user` be `nil` here?