explicitly set current_user = user in session create