changed authenticate to return a user