when current_user is admin we don't need to scope by user_id