Really patched security issue by adding MainApp.current_user to JS