What if you moved the logic for determining ift he username and password are valid onto a class method on the user?

This keeps the logic for determining user authentication closer to the data that is used to determine if the user is valid; and makes it far easier to test.