remove hard coded user id, current_user instead