user: add authenticate().