Use the current user, not the request owner