allow string userid in User.authenticate

As per #3