The current_user and user were swapped in the permission check
for the UsersHelper#user_display_name method, resulting in
authenticated users seeing an unconfirmed user's full name on
the profile page.