the current user is on the session, not the user model object