Don't hardcode the `User` model in django-authority

Use the `django.contrib.auth.get_user_model` and `settings.AUTH_USER_MODEL` instead.