Use the email in the function argument for auth

The authentication method kept looking up the form for the email
parameter instead of using the email provided in the function argument.
This change makes the authenticate method reusable without form, for
example with basic authentication.