User::create should return the user id; don't re-authenticate.