oops, we're not looking at current_user here directly