fix authentication bug

`current_user` was getting set without being saved if the user didn’t
already exist in the database.