Fixed a bug in User#authenticate