make setUser protected so it can only be set by a class extending base auth