Hidden fields can be a security issue.  See the assignment here: http://apollo.launchacademy.co/assignments/advanced-controllers-and-nested-resources

With nested resources, you shouldn't have to pass this information in.  Throw in a binding.pry to check your params to see what information you have access to without these hidden fields.  

Also, you have access to Devise's `current_user` method in your controller, so in your strong params method in your `ReviewsController` you can merge in the `current_user` to your params hash.

```ruby
params.require(:review).permit(:title, :body, :rating).merge(user: current_user)
```