This should just work on the current user and should not be accessible to anonymous users