no need to pass user to policies, will use User.current instead.