added route constraints for current_user