clean() of AuthenticateForm already authenticates the user, you do not need to do it again