Protect current_user method in application_controller