Use only current_user in abilities

May need to be reverted in the future but for now it's complicated
to access user and tenant in serializers.
This commit is kinda "hoping" that we didn't actually used the context
in ability as users only belong to one tenant.