current_user should be @user

On the user show view @user should be passed into policy not
current_user as we already have current_user available in authorizers.