Return the authenticated user from Authorize()

Otherwise, it is impossible to know which user was just authenticated.