Clean up user account creation code

* if you authenticate and don't have a User object, we create one
  there because doing otherwise is dumb.
* because we do that now, I liberally removed all the bandaid
  code I had because there was no guarantee there was a User object.
* fixed the tests accordingly.
* nixed some TODO code.