spree/spree_reviews — pull request #108 by dougbradbury (2014-06-10 04:02:59+00:00)
Title: remove hidden userid field and set the user id from the current_user

Alternative to PR #85. the user_id should be sent in the form. This would allow someone to post feedback posing as someone else. Instead, set the user from the current user in the session