proper CurrentUser usage for route constraints