`current_user_can()` was being called too early

Related issues #881, #565