You should not need to pass the `current_member.id` into the form. If you do, then I could just set it to a different id and post as anyone else! UH OH!