Auth using AbstractBaseUser - not tested