current_user can't be false