Fix: check current_user before checking for power user