Require user instead of failing to access current_user