Move Auth handling to lightgear/user