made #current_user more explicit and secure