This was an admin-only field that was exposed, and there were no tests
for doing this as an admin and getting that response. In CE, we renamed
the `user` option to `current_user`, and inadvertently broke this.