update controller to scope to current_user