first sighting: I don't think I've seen someone write exactly && nil before.

Apparently to avoid having the return value from errors.add — which should be done solely for its side effect, not to get a return value -- inadvertently being used as a return value for user. It wouldn't make sense to return from user. That should only return a User or nil. And more statically typed languages would allow that to be expressed/enforced from type annotations alone, which would have caught the mistake of returning errors.add if someone had accidentally attempted to return that.

Having user (and therefore call) return nil is key to the unless @current_user working.

I like how null and false, although both falsy, can be treated differently when a useful need for such distinction, such as this case, arises.