I don't know how that could happen given that the current user is set based on the client certificate. If you search in that file you will notice that params[:consumer] is not used anywhere.