rename user to auth_object

assuming the name of 'user' makes for weirdness if the object that's actually in use contains a user...