do we want to get the user from params or do we want to use current_user?