set current_user inside @require_login