forget user && user.authenticate. Is possible to have a null user