Assign user to current_user in the controller which is safer than having it submitted through the form, which can be spoofed.