Allow to set callback_url directly
current_user can't be false