Use the `can?` helper instead of `current_user.can?`

Fixes #15513.

See merge request !3882