Return 422 instead of letting the server blow up with no current_user