Shiro: authenticate user after it's been created for the first time.