WIP, part of Bug 1025805 - multiple referrers over time

Passing the user value through on `authenticate` in the same way as is currently done on `create`