Why not just use `/current` as defined above?  If it's an api request, `@current_user` is already set using the token