May be instead of having a _tmp_username/password and a _verified_username/password, you could just save _username and _password right when authenticate is called, and when you're about to use it to do whatever you want, you check whether the uid is None or not. If it's not None then those values are good.