Eliminating explicit reference to current_user

Now any controller methods/helpers can be called from the whitelist
definitions.