refactored User.authenticate