Feels like the last bit should be moved into a model method. `@form.has_whitelisted_user?(user)`? Otherwise we're kind of breaking LoD.