Move authentication to user model