Move authentication into User model