User.authenticate returns nil if it fails, this will throw exception