Only authenticate instead of fully login

This can be more useful because we don't always need to login the session.

The developers can always call django.contrib.auth.login on the authenticated user object if they want to. We only handle the credentials-stripping part for them.