Should we just use <code>current_company</code>? As it stands anyone could send an id and get that company modified.