Fixes authenticate()

AuthComponent::identify() and AuthComponent::login() go through the authenticate function, if false is returned, getUSer() would never be run and the plugin wouldn't work.

To make the stateless authentication work I personally use $this->Auth->identify(), otherwise $this->Auth->login() creates a session.