UserModel::authenticate now returns User object