add missing comma
ensure the currentUser injection happens even if there is no currentUser
move openInBox to action and fix outlet setup so that it uses the correct controller and named outlet