Hmm I think a TryMatchUser paradigm would be better, so:
public bool TryMatchUser(string authorizationToken, out User matchedUser) {...}