So there looks to be a bug here. You are only requiring authentication for `create`. Will `current_user` always be defined here?