It works now. Removed debug code. AttemptAuth now checks if user is managed.